The @sauruslord/eslint-config npm package is identified as containing malicious code that compromises the host system entirely. According to the source advisory, any system with this package installed or executed should be treated as fully compromised. The malicious package may have granted external attackers full control, and thus all credentials stored on the system must be rotated from a different, secure environment. Removal of the package is necessary but insufficient to ensure system integrity due to potential persistence of additional malicious software.

Complete system compromise on any machine where the package is installed or run. All secrets and keys stored on the compromised system are at risk and must be rotated. The attacker may have persistent access beyond the presence of the package itself.

Immediately remove the @sauruslord/eslint-config package from all affected systems. Rotate all secrets, keys, and credentials from a separate, trusted machine. Conduct a thorough investigation and remediation of the affected systems, as removal of the package alone does not guarantee elimination of all malicious artifacts. Consider rebuilding or restoring systems from known good backups.