The 'motiondnb' package in the npm ecosystem is identified as containing malicious code that compromises the host system completely. According to the source details, installation or execution of this package results in full system compromise, potentially allowing attackers to control the machine and access sensitive information such as secrets and keys. The advisory warns that simply removing the package may not eradicate all malicious artifacts introduced. There is no CVSS score available for this threat, and no known exploits in the wild have been reported. No patch or remediation is provided, and the vendor has not issued an official fix.

Full system compromise on any computer with the 'motiondnb' package installed or running. Attackers may gain complete control, leading to potential theft or misuse of secrets, keys, and other sensitive data. The persistence of malicious software beyond package removal increases the risk and complexity of remediation.

Remove the 'motiondnb' package immediately from all affected systems. Rotate all secrets and keys stored on the compromised machines from a separate, trusted device. Because full control may have been given to an attacker, consider rebuilding or thoroughly cleaning affected systems to ensure complete removal of malicious software. No official patch or fix is available; rely on removal and credential rotation as primary mitigations.