The @bapiweb-ux/bapi-header npm package is identified as containing malicious code that compromises the host system completely. According to the source details from the GHSA malware advisory, installation or execution of this package results in full system compromise, potentially allowing an attacker full control. The advisory strongly recommends immediate rotation of all secrets and keys from a separate, uncompromised system. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors introduced.

Full system compromise on any computer with the package installed or running. Potential exposure and theft of all stored secrets and keys. Persistent malicious presence may remain even after package removal, indicating possible backdoors or additional malware installed by the malicious package.

Remove the @bapiweb-ux/bapi-header package immediately. Rotate all secrets and keys stored on the affected system from a different, trusted computer. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious software. No official patch or fix is available; remediation relies on removal and secret rotation.