The 'sync-logger' package in the npm ecosystem has been identified as containing malicious code. Installation or execution of this package results in a full system compromise, potentially allowing an attacker to control the affected computer. Due to the nature of the compromise, all sensitive credentials on the system must be rotated immediately from a secure environment. Removal of the package alone is insufficient to ensure system integrity because the attacker may have installed additional persistent malicious components.

Complete compromise of the affected system, including potential unauthorized access to all stored secrets and keys. The attacker may have persistent control beyond the presence of the malicious package itself, posing a significant risk to confidentiality, integrity, and availability of the system and its data.

Remove the 'sync-logger' package immediately. Rotate all secrets and keys stored on the affected system from a separate, secure computer. Conduct a full system investigation and remediation, as removal of the package alone does not guarantee elimination of all malicious software. Consider rebuilding the system from a known good backup or reinstalling the operating system to ensure complete eradication of the compromise.