The 'nottuff13' package in the npm ecosystem is identified as malicious software. Installation or execution of this package results in full system compromise, potentially granting attackers complete control over the affected computer. Due to the nature of the compromise, simply uninstalling the package is insufficient to ensure system integrity, as additional malicious software may persist. The advisory recommends immediate secret and key rotation from a separate, uncompromised system to mitigate potential damage.

Full system compromise on any computer with the 'nottuff13' package installed or running. Potential unauthorized access to all stored secrets and keys. Persistence of malicious software beyond package removal is likely, increasing risk of ongoing unauthorized control.

Remove the 'nottuff13' package immediately. Rotate all secrets and keys stored on the compromised computer from a different, secure device. Because full control may have been given to an attacker, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components. No official patch or fix is available as this is a malicious package rather than a vulnerability in legitimate software.