The @bcs-mi-ui/message package distributed via npm is identified as malicious software that, once installed, grants an attacker full control over the affected computer. This level of compromise implies that the attacker can access all stored secrets and keys, potentially leading to further breaches. Due to the nature of the compromise, simply uninstalling the package is insufficient to restore system integrity, as additional malicious components may have been installed. There is no CVSS score or detailed technical exploit information available, and no known exploits in the wild have been reported. The package is not a cloud service, so remediation depends on the user removing the package and performing incident response on the affected system.

Full system compromise on any computer with the package installed or running. All secrets and keys stored on the system are considered exposed and must be rotated from a secure environment. The attacker may have persistent access beyond the presence of the package itself, making the system untrustworthy until fully cleaned or rebuilt.

Remove the @bcs-mi-ui/message package immediately from all affected systems. Rotate all secrets and keys stored on those systems from a different, trusted computer. Conduct a thorough incident response to identify and remove any additional malicious software or backdoors that may have been installed. Because full control may have been given to an attacker, consider rebuilding affected systems from known good backups or reinstalling the operating system to ensure complete remediation.