The @fhkry/baileys-v2 npm package is identified as containing malicious code that grants full control over the infected system to an attacker. This level of compromise implies that any sensitive information, including secrets and keys, may be exposed or stolen. The malicious package can lead to persistent infection beyond the presence of the package itself, making remediation challenging. There is no CVSS score available, and no patch or fix is indicated. The threat is specific to the npm ecosystem and the named package.

Full system compromise on any computer with the package installed or running. Potential exposure and theft of all stored secrets and keys. Persistent infection risk even after package removal.

Remove the @fhkry/baileys-v2 package immediately. Rotate all secrets and keys from a different, uncompromised computer. Because the system may remain compromised after removal, consider full system reimaging or thorough incident response procedures. No official patch or fix is available; remediation relies on removal and secret rotation.