The nodemon-slint npm package is identified as containing malicious code that compromises the host system completely. According to the source details, any computer with this package installed or running should be considered fully compromised, with potential unauthorized access to secrets and keys. The package removal alone is insufficient to ensure system cleanup, as persistent malicious software may remain. There is no CVSS score or detailed technical vulnerability data available. No known exploits in the wild have been reported. This is a supply chain malware incident affecting the npm ecosystem.

Full system compromise on any computer with the nodemon-slint package installed or running. Potential exposure and theft of all stored secrets and keys on the affected system. The attacker may have persistent access beyond the presence of the malicious package itself.

Remove the nodemon-slint package immediately from all affected systems. Rotate all secrets and keys stored on the compromised machines from a separate, secure computer. Conduct a thorough investigation and remediation of the affected systems, as removal of the package does not guarantee complete eradication of malicious software.