Malware in statist-browser-typed-client-eventea.projects.pwahelp

A malicious npm package named statist-browser-typed-client-eventea.projects.pwahelp was identified and published on GitHub's advisory database. The package contains malware that grants full control of affected systems to an outside entity.\n\nAny computer with this package installed or running should be considered fully compromised. The advisory recommends immediate rotation of all secrets and keys from a different, unaffected computer. While the package should be removed, complete removal of all malicious software cannot be guaranteed due to the level of system compromise.\n\nThe incident was disclosed on 2026-08-08 via GitHub's security advisory system.