The 'changiairportpromax' npm package is identified as malicious software that, when installed or executed, fully compromises the host system. This compromise includes potential unauthorized access and control by an external attacker. Due to the severity of the compromise, all credentials and secrets stored on the affected system must be rotated from a separate, secure environment. The package removal is necessary but insufficient to fully remediate the infection, as residual malicious components may persist.

Full system compromise on any computer with the package installed or running. All secrets and keys stored on the compromised system are at risk and must be considered exposed. The attacker may have persistent access beyond the presence of the package itself.

Immediately remove the 'changiairportpromax' package from all affected systems. Rotate all secrets, keys, and credentials from a separate, uncompromised computer. Conduct a thorough investigation and remediation of the affected systems to identify and remove any additional malicious software or backdoors. There is no official patch or fix for this malicious package; mitigation relies on removal and credential rotation.