This threat involves a malicious npm package identified as 'dowload_ebok_river_of_time_by_naomi_judd_marcia_wilkie_i1ze3'. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker to gain complete control. The advisory warns that all secrets and keys on the compromised system should be rotated from a separate, secure environment. Due to the depth of compromise, simply uninstalling the package may not remove all malicious software introduced by the attacker. There is no CVSS score or detailed technical exploit information available. No patch or remediation beyond removal and secret rotation is provided.

Full system compromise on any computer where this package is installed or run. Potential exposure and theft of all stored secrets and keys. Persistent malicious presence may remain even after package removal, indicating a high risk of ongoing unauthorized access.

Immediately remove the malicious package from affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised machine, performing this rotation from a separate, trusted system. Because the attacker may have established persistent control, consider full system reimaging or restoration from a known good backup to ensure complete remediation.