The 'nottuff18' package in the npm ecosystem is identified as malicious software. According to the source details, any system with this package installed should be considered fully compromised. The malicious code potentially grants attackers full control over the affected system, risking exposure of sensitive credentials and keys. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts. No CVSS score or patch information is available, and no known exploits in the wild have been reported.

Full compromise of the affected computer is expected upon installation or execution of the 'nottuff18' package. This includes potential unauthorized access to all secrets and keys stored on the system. The integrity and confidentiality of the system and its data are severely impacted. The threat persists even after package removal, indicating possible persistent malicious presence.

Remove the 'nottuff18' package immediately from all affected systems. Assume full compromise of any system where the package was installed. Rotate all secrets and keys from a different, secure computer to prevent unauthorized access. Conduct a thorough investigation and remediation of the affected systems to identify and remove any residual malicious software. No official patch or fix is available; mitigation relies on removal and credential rotation.