Name of the Vulnerable Software and Affected Versions cage-js versions all

Description The issue concerns malicious code in the software that downloads and runs a script from a remote server as a postinstall script. Any computer with this package installed should be considered fully compromised, and all secrets and keys stored on it should be rotated immediately from a different computer.

Recommendations Remove the cage-js package, however, be aware that this may not remove all malicious software resulting from its installation. As a precaution, consider the computer fully compromised and take necessary steps to secure it, such as rotating all secrets and keys stored on it from a different computer.