The @genie-auth/config npm package is identified as containing malicious code that compromises the host system completely. According to the source details, any computer with this package installed or running should be considered fully compromised, implying that attackers may have gained full control. The package removal alone is insufficient to ensure system integrity, as additional malicious software may persist. The advisory recommends rotating all secrets and keys from a different, uncompromised machine to mitigate potential damage.

Full system compromise on any computer with the package installed or running. Potential unauthorized access to all stored secrets and keys. Persistence of malicious software beyond package removal is likely, increasing the risk of ongoing unauthorized control and data breach.

Remove the @genie-auth/config package immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Conduct a thorough investigation and remediation of the affected system to identify and remove any additional malicious software. Consider rebuilding the system from a known good backup or reinstalling the operating system to ensure complete removal of the compromise.