The 'nottuff6' package in the npm ecosystem is identified as containing malicious code that fully compromises affected systems. According to the source advisory, any computer with this package installed should be considered fully compromised, necessitating immediate rotation of all secrets and keys from a separate, secure system. The package removal alone is insufficient to ensure system integrity due to potential persistent backdoors or additional malware installed by the attacker.

Full system compromise on any computer with the 'nottuff6' package installed. All secrets and keys stored on the compromised system are at risk and should be considered exposed. The attacker may maintain persistent access even after package removal, leading to ongoing security risks.

Remove the 'nottuff6' package immediately from all affected systems. Rotate all secrets and keys from a different, uncompromised computer. Conduct a thorough security assessment and consider rebuilding affected systems to ensure removal of all malicious components, as package removal alone does not guarantee full remediation.