The 'websight-p2p' package distributed via npm has been identified as containing malicious code that grants full control of the host computer to an attacker. Installation or execution of this package results in a complete compromise of the affected system. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors. The advisory recommends immediate secret and key rotation from a separate, uncompromised system to mitigate ongoing risk.

Any system with the 'websight-p2p' package installed or running should be considered fully compromised, implying potential unauthorized access, data exfiltration, and persistent control by an attacker. All credentials and secrets stored on the system are at risk and must be rotated promptly. The presence of this package undermines system integrity and confidentiality.

Remove the 'websight-p2p' package immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Because full control may have been granted to an attacker, further forensic analysis and system restoration from a trusted backup are recommended. No official patch or fix is available; remediation relies on removal and credential rotation.