Fix · Security mistakes

I installed a package that may be malicious

UrgentSecurity

What you may see

A package I installed has a strange name or a warning
My computer behaves strangely after an install command

Most likely cause

Install scripts run code on your computer; fake or look-alike package names are a known way to steal keys.

Check first (about two minutes)

Search the package name on the official site: when was it published, how many users, who owns it?

The fix prompt

What you type here never leaves your browser. The search runs on this page, and nothing is sent to a server or to an AI.

The exact error or what you see

What you did before it happened

Kept only in this browser, on this device. Keys and passwords are removed before anything is saved.

Prompt language

You are a calm senior security engineer who helps people who are not developers after they exposed a secret by mistake. I am not a developer, so explain every step in plain words and tell me exactly which button, menu or command you mean. If you are not sure about something, say so; do not guess.

This is urgent. Do the safety steps first, before anything else.

THE PROBLEM
I installed a package that may be malicious

THE EXACT ERROR OR WHAT I SEE
[paste the exact error here]

WHAT I DID BEFORE IT HAPPENED
[write in a few words what you did before it happened]

MOST LIKELY CAUSE
Install scripts run code on your computer; fake or look-alike package names are a known way to steal keys.

DO THESE STEPS, IN THIS ORDER
1. Show the package details and what it does on install (install scripts). If it looks wrong, tell me to stop and not run the project.
2. If it ran: list the keys and passwords that were on that computer or in that project, and help me rotate them in order of importance.
3. Remove it from package.json and the lock file, reinstall clean, and pin the exact versions of packages I trust.
Stop and tell me if what you see does not match a step. Do not skip ahead.

CHECK THAT IT WORKED
- The package is gone from the project, exposed keys are replaced, and the install shows only known packages.
Tell me exactly what I should see on the screen when it works.

DO NOT CHANGE
- Do not run the project again before checking.
- Anything I did not ask about: the design, the text, other pages, other settings or the data.
- Do not delete files, data or branches, do not reset or force-push, and do not rewrite history, unless you first show me exactly what would be lost and I say yes.
- Do not paste, print or ask me to paste a password or secret key into this chat. If one is needed, tell me which settings page of the right service to store it in.

WHEN YOU FINISH
Explain in simple words what you changed (file by file or setting by setting), why you changed it, and how I can undo it.

Paste it into Claude, ChatGPT, Gemini or Cursor, then follow what it says.

After you tried it, did it work?

Steps

Show the package details and what it does on install (install scripts). If it looks wrong, tell me to stop and not run the project.
If it ran: list the keys and passwords that were on that computer or in that project, and help me rotate them in order of importance.
Remove it from package.json and the lock file, reinstall clean, and pin the exact versions of packages I trust.

Do not do this

Do not install a package because an AI or a chat said so without checking.
Do not run the project again before checking.

Try another entry