The 'nyt-cms' package on npm has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the affected system, potentially granting an attacker complete control. Because the malicious code may install additional software or backdoors, simply removing the package does not ensure the system is clean. This threat is categorized as a malicious package rather than a traditional vulnerability and does not have a CVSS score. No known exploits in the wild have been reported yet.

Systems with the 'nyt-cms' package installed or running should be considered fully compromised. Attackers may have gained full control over the system, risking exposure or theft of all stored secrets and keys. The presence of this package undermines system integrity and confidentiality.

Remove the 'nyt-cms' package immediately. Rotate all secrets and keys from a different, uncompromised system to prevent unauthorized access. Because full system compromise is likely, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components. No official patch or fix is available as this is a malicious package rather than a software flaw.