The 'omgyesyesyes' package in the npm ecosystem is identified as malicious. Installation or execution of this package results in full compromise of the host system, potentially allowing attackers complete control. Due to the severity of the compromise, simply uninstalling the package is insufficient to ensure system integrity. The advisory emphasizes that all credentials and secrets on the affected system should be rotated from a separate, trusted environment to mitigate ongoing risk.

Full system compromise on any machine with the 'omgyesyesyes' package installed or running. Potential unauthorized access to all stored secrets and keys. Persistence of malicious software beyond package removal is likely, posing ongoing security risks.

Remove the 'omgyesyesyes' package immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Because the system may remain compromised even after removal, consider rebuilding or thoroughly cleaning the affected environment. No official patch or fix is available; remediation relies on removal and credential rotation.