The dogfood-search package in the npm ecosystem has been identified as containing malicious code that compromises the host system completely. According to the source details, any system with this package installed should be considered fully compromised, with potential unauthorized control by an external entity. The package removal alone is insufficient to ensure system integrity, necessitating secret and key rotation from a separate, trusted machine.

Full system compromise on any computer with the dogfood-search package installed or running. Potential unauthorized access to all stored secrets and keys. Removal of the package does not guarantee removal of all malicious artifacts or backdoors.

Remove the dogfood-search package immediately. Rotate all secrets and keys stored on the affected computer from a different, uncompromised machine. Conduct a thorough investigation and remediation of the affected system, as removal of the package alone may not eliminate all malicious software.