The nodemon-patch package in the npm ecosystem is identified as containing malicious code that results in a full system compromise upon installation or execution. The compromise is severe enough that all secrets and keys on the affected system should be considered exposed and must be rotated from a separate, uncompromised device. Due to the depth of control gained by the attacker, simply uninstalling the package may not remove all malicious artifacts or backdoors introduced. No CVSS score or patch information is available, and no known exploits in the wild have been reported at this time.

Any system with the nodemon-patch package installed or running is fully compromised, meaning an attacker can potentially control the system and access all stored secrets and keys. This poses a critical security risk including potential data theft, unauthorized access, and persistent malicious presence on the device.

Remove the nodemon-patch package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored on the compromised machines, performing this rotation from a separate, trusted device. Because full control may have been given to an attacker, consider the affected systems untrusted and perform thorough forensic analysis and remediation beyond just package removal. No official patch or fix is available; the best mitigation is removal and credential rotation.