The @bcs-mi-ui/message-block npm package is identified as containing malicious code that results in full compromise of any computer where it is installed or executed. The compromise includes potential exposure and theft of secrets and keys stored on the system. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors, implying persistent attacker presence. No CVSS score or detailed technical vulnerability information is provided. There is no indication of known exploits in the wild or available patches.

Full system compromise on any computer with the package installed or running. All secrets and keys stored on the affected system should be considered compromised and require immediate rotation from a secure environment. The attacker may have persistent access beyond the presence of the package itself.

Immediately remove the @bcs-mi-ui/message-block package from all systems. Rotate all secrets, keys, and credentials that were stored or used on affected machines, performing this action from a different, secure computer. Conduct a thorough investigation for additional malicious software or backdoors, as removing the package alone does not guarantee full remediation.