The 'sixseven2' package in the npm ecosystem is identified as malicious software. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker complete control. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious components or backdoors that have been installed. This threat is cataloged under MAL-2026-10374 and has no associated CVSS score or known exploits in the wild at this time.

Full system compromise on any computer with the 'sixseven2' package installed or running. All stored secrets and keys on the affected system are at risk and must be considered compromised. The attacker may have persistent access beyond the presence of the package itself.

Remove the 'sixseven2' package immediately. Rotate all secrets and keys from a separate, uncompromised system. Because the system may remain compromised even after removal, consider rebuilding or thoroughly cleaning the affected system. No official patch or fix is available as this is a malicious package rather than a vulnerability with a patch.