The 'nottuff9' package in the npm ecosystem is identified as malicious software. Installation or execution of this package results in full system compromise, potentially allowing an attacker complete control over the affected computer. Due to the severity of the compromise, simply uninstalling the package is insufficient to ensure system integrity. The advisory recommends immediate secret and key rotation from a different, secure machine to mitigate the risk of credential theft or misuse.

Any system with the 'nottuff9' package installed or running should be considered fully compromised. Attackers may have obtained full control over the system, including access to stored secrets and keys. This level of compromise can lead to unauthorized access, data theft, and persistent malicious presence beyond the package itself.

Remove the 'nottuff9' package immediately. Rotate all secrets and keys stored on the compromised computer from a separate, secure device. Because the system may be fully controlled by an attacker, consider rebuilding or replacing the affected system to ensure complete remediation.