The 'ai-node-relay' package in the npm ecosystem is identified as containing malicious code that compromises the host system completely. Installation or execution of this package grants an attacker full control over the affected computer. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors. This threat is classified as a malicious package rather than a traditional vulnerability and does not have a CVSS score assigned.

Full system compromise on any computer with the 'ai-node-relay' package installed or running. All secrets and keys stored on the compromised system are at risk and should be considered exposed. The attacker may maintain persistent access beyond removal of the package.

Remove the 'ai-node-relay' package immediately from all affected systems. Rotate all secrets, keys, and credentials stored on the compromised computers from a separate, secure device. Because full control may have been given to an attacker, consider rebuilding or thoroughly cleaning affected systems to ensure removal of all malicious software.