The 'speed2' package in the npm ecosystem has been identified as containing malicious code. According to the source advisory, any computer with this package installed or running is considered fully compromised, implying that attackers may have gained complete control over the system. The advisory recommends immediate rotation of all secrets and keys from a separate, uncompromised device. Removal of the package alone is insufficient to guarantee eradication of the threat, as the attacker may have deployed further malicious software.

Systems with the 'speed2' package installed are fully compromised, potentially allowing attackers complete control over the affected computer. This includes unauthorized access to all stored secrets and keys, which must be rotated immediately. The persistence of malicious software beyond the package itself means that the system's integrity and confidentiality are severely impacted.

Remove the 'speed2' package immediately from all affected systems. Rotate all secrets, keys, and credentials from a separate, trusted computer to prevent further unauthorized access. Because the system may be fully compromised, consider a full system rebuild or forensic analysis to ensure complete removal of malicious software. No official patch or fix is available; remediation relies on removal and credential rotation.