Malware in @reference-web/pmp-i18n

A malware incident was identified in the npm package @reference-web/pmp-i18n, published as GitHub Advisory GHSA-m6f5-jgw6-8m97 on June 29, 2026.\n\nAny computer with this package installed or running should be considered fully compromised. The malware grants outside entities full control of affected systems, potentially allowing persistent access beyond package removal.\n\nImmediate remediation requires rotating all secrets and keys from a separate, uncompromised computer, and removing the package. However, complete removal of all malicious artifacts cannot be guaranteed due to the level of system compromise.\n\nUsers should assume that any credentials, API keys, or sensitive data accessible from affected systems have been exposed and require rotation.