The 'imillegal1' npm package is identified as malicious software that, once installed or executed, compromises the host system completely. The compromise includes potential unauthorized access and control by an external entity. Due to the severity of the compromise, simply uninstalling the package may not remove all malicious components or backdoors introduced. This threat is documented under MAL-2026-10306 and GHSA-98c4-6856-4822, with no CVSS score assigned. There are no known exploits in the wild reported at this time.

Full system compromise on any computer running or having installed the 'imillegal1' package. All secrets and keys stored on the compromised system are at risk and should be considered exposed. The attacker may maintain persistent access even after package removal.

Remove the 'imillegal1' package immediately from all affected systems. Rotate all secrets, keys, and credentials from a separate, uncompromised machine. Due to the potential for persistent compromise, consider rebuilding or thoroughly cleaning affected systems. No official patch or fix is available as this is a malicious package rather than a vulnerability in legitimate software.