The 'nottuff19' package in the npm ecosystem has been identified as containing malicious code that compromises the host system completely. According to the source advisory, installation or execution of this package results in full system compromise, potentially allowing an attacker to control the affected computer. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors. The advisory recommends immediate secret and key rotation from a secure environment to mitigate ongoing risk.

Any system with the 'nottuff19' package installed or running should be considered fully compromised. This includes potential unauthorized access to all stored secrets and keys, which must be rotated immediately. The attacker may maintain persistent control beyond the presence of the package itself, posing a severe security risk to the affected environment.

Remove the 'nottuff19' package from all affected systems. Immediately rotate all secrets and keys from a separate, trusted computer to prevent further unauthorized access. Because the system may remain compromised even after removal, consider rebuilding or thoroughly cleaning the affected systems. No official patch or fix is available; remediation relies on removal and secret rotation.