Malware in @services-lib/application-http-client

A malicious package named @services-lib/application-http-client was published to npm and contains malware. Any computer with this package installed or running should be considered fully compromised.\n\nThe malware grants outside entities full control of affected systems. All secrets and keys stored on compromised computers should be rotated immediately from a different, unaffected computer.\n\nWhile the package should be removed, complete removal of all malicious software cannot be guaranteed due to the level of system compromise achieved by the malware.\n\nThe incident was disclosed via GitHub Advisory GHSA-jvx5-rh7w-w4fj on 2026-06-29.