The captainindia package in the npm ecosystem is identified as malicious. Installing or running this package results in a full system compromise, allowing an attacker to gain complete control over the affected computer. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors. The advisory recommends considering all secrets and keys on the system as compromised and rotating them immediately from a separate, secure environment.

Full compromise of any computer with the captainindia package installed or running. All secrets and keys stored on the compromised system are at risk and should be considered exposed. The attacker may maintain persistent access even after removal of the package.

Remove the captainindia package immediately. Rotate all secrets and keys stored on the compromised system using a different, secure computer. Because full system compromise is possible, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components.