The 'gpapp' package in the npm ecosystem is identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker to gain complete control. Due to the nature of the compromise, sensitive information such as secrets and keys stored on the system are at risk and must be rotated from a secure environment. Simply uninstalling the package is insufficient to fully remediate the threat, as additional malicious software may persist on the system.

Full system compromise on any computer with the 'gpapp' package installed or running. All stored secrets and keys on the affected system are considered compromised and must be rotated. The attacker may maintain persistent access beyond the presence of the package itself.

Immediately remove the 'gpapp' package from affected systems. Rotate all secrets and keys stored on the compromised computer from a different, trusted machine. Conduct a thorough investigation and remediation of the affected system, as removal of the package alone does not guarantee elimination of all malicious components.