Malware in @ravespaceio/rave-engine

A malware-laden version of the npm package @ravespaceio/rave-engine has been identified and published to the npm registry. The package grants full control of affected systems to an outside entity.\n\nAny computer with this package installed or running should be considered fully compromised. All secrets, keys, and credentials stored on affected systems must be rotated immediately from a different, unaffected computer.\n\nWhile the malicious package should be removed, complete remediation cannot be guaranteed due to the level of system compromise. Additional forensic investigation and system hardening may be necessary to ensure all malicious artifacts are eliminated.\n\nThe incident was disclosed via GitHub Advisory GHSA-72c8-h2pr-vwjg on 2026-06-23.