This threat involves a malicious npm package named '@jplopezy/connectivity-test-do-not-install'. Installation or execution of this package results in a full compromise of the host system. The attacker potentially gains complete control, risking exposure of all stored secrets and keys. Due to the depth of compromise, simply uninstalling the package is insufficient to ensure system integrity. The advisory strongly recommends rotating all credentials from a separate, secure environment. No CVSS score or patch information is available, and no known exploits in the wild have been reported.

Full system compromise on any computer with the package installed or running. All secrets and keys stored on the compromised system are at risk and must be rotated immediately. The attacker may maintain persistent access beyond the presence of the package itself.

Remove the '@jplopezy/connectivity-test-do-not-install' package immediately. Rotate all secrets and keys stored on the affected system using a different, uncompromised computer. Because full control may have been given to an attacker, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components.