Malware in poc-publish-test-su-doughnym

A malicious npm package named poc-publish-test-su-doughnym was identified and published to the npm registry. The package contains malware that grants full control of affected systems to an outside entity.\n\nAny computer that has installed or executed this package should be considered fully compromised. All secrets, keys, and credentials stored on affected systems must be rotated immediately from a different, uncompromised computer.\n\nWhile the package should be removed, complete remediation cannot be guaranteed due to the potential for the malware to have established persistent access or additional backdoors on the compromised system.\n\nThe incident was disclosed via GitHub Advisory GHSA-fg75-hmqx-qfw9 on 2026-06-25.