The 'apps-gpt' package in the npm ecosystem is identified as malicious software. Installation or execution of this package results in a full compromise of the host system. The attacker potentially gains complete control, putting all stored secrets and keys at risk. Due to the severity of the compromise, simple removal of the package is insufficient to restore system integrity. No CVSS score or patch information is available, and no known exploits in the wild have been reported. The advisory strongly recommends immediate secret/key rotation from a separate, uncompromised system.

Complete compromise of any computer with the 'apps-gpt' package installed or running. All stored secrets and keys on the compromised system are at risk and should be considered exposed. The attacker may maintain persistent access beyond removal of the package, leading to potential ongoing malicious activity.

Remove the 'apps-gpt' package immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Because the system may remain compromised even after package removal, consider rebuilding or fully restoring the system from a known good backup. No official patch or fix is available; remediation relies on removal and secret rotation.