The 'bomboclatwallahi' package in the npm ecosystem is identified as malicious. Installation or execution of this package results in full compromise of the host system, potentially granting an attacker complete control. Due to the severity of the compromise, simply uninstalling the package may not remove all malicious artifacts. The advisory recommends treating any system with this package as fully compromised and rotating all credentials from a secure environment.

Full system compromise on any computer with the package installed or running. Potential exposure and loss of all stored secrets and keys. Persistence of malicious software beyond package removal is likely, indicating a high risk of ongoing unauthorized access.

Remove the 'bomboclatwallahi' package immediately. Rotate all secrets and keys stored on the affected system from a different, secure computer. Because full system compromise is likely, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components. No official patch or fix is available; remediation relies on removal and credential rotation.