All versions of maleficent contain malicious code. The package is a demonstration of possible risks when installing npm packages. It gathers system information such as: environment variables, OS information, network interface, AWS credentials, npm credentials and ssh keys. The package prints the information to a local file but does not upload it to a remote server.

Recommendation

Remove the package from your environment. There is no further compromise.

References

• https://www.npmjs.com/advisories/951