The 'nottuff11' package in the npm ecosystem is identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker complete control. Due to the severity of the compromise, all sensitive credentials on the affected machine must be rotated from a separate, secure environment. The package removal is necessary but insufficient to fully remediate the infection, as additional malicious components may persist.

Full system compromise on any computer with the 'nottuff11' package installed or running. This includes potential unauthorized access to all stored secrets and keys, necessitating immediate credential rotation. The persistence of malicious software beyond package removal increases the risk of ongoing unauthorized access and control.

Remove the 'nottuff11' package immediately from affected systems. Rotate all secrets and keys stored on the compromised machine using a different, trusted computer. Because removal of the package may not eliminate all malicious software, consider a full system reinstallation or forensic analysis to ensure complete remediation.