The nodepack-daemon package distributed via npm is identified as malicious software. Installation or execution of this package results in full compromise of the host system, potentially allowing an attacker complete control. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious components or backdoors. The advisory recommends immediate secret and key rotation from a separate, secure system to mitigate ongoing risk.

Full system compromise on any computer with the nodepack-daemon package installed or running. All stored secrets and keys on the affected system are at risk and must be considered compromised. The presence of this package may lead to persistent malicious software beyond the package itself.

Remove the nodepack-daemon package immediately. Rotate all secrets and keys stored on the affected system from a different, uncompromised computer. Due to the potential for persistent compromise, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components.