Malware in @web-3d-tool/sdk

A malware incident was identified in the npm package @web-3d-tool/sdk and published via GitHub Advisory GHSA-qmfq-m796-v557 on June 11, 2026.\n\nAccording to the advisory, any computer with this package installed or running should be considered fully compromised. The malware grants outside entities full control of affected systems.\n\nImmediate remediation steps include removing the package and rotating all secrets and keys from a different, unaffected computer. However, the advisory notes that removal of the package may not eliminate all malicious software that resulted from the installation, given the level of system compromise.\n\nThe package should be avoided entirely, and users should audit their systems for any signs of compromise or unauthorized access.