The 'vkzmn' package in the npm ecosystem is identified as malicious. Installation or execution of this package results in full compromise of the host system, potentially allowing an attacker complete control. Due to the severity of the compromise, simply uninstalling the package may not remove all malicious artifacts. The advisory recommends immediate secret and key rotation from a separate, uncompromised system to mitigate ongoing risk.

Full system compromise occurs upon installation or execution of the 'vkzmn' package. This includes potential unauthorized access to all stored secrets and keys, which must be considered compromised. The persistence of malicious software beyond package removal increases the risk of continued attacker control.

Remove the 'vkzmn' package immediately. Rotate all secrets and keys stored on the affected system using a different, trusted computer. Due to the possibility of persistent malicious software, consider full system remediation or rebuild to ensure complete removal of the threat.