The @bc-workspace/utils npm package is identified as containing malicious code that fully compromises the host computer. Installation or execution of this package results in a complete breach of the system, potentially exposing all stored secrets and keys. Due to the extent of the compromise, simply uninstalling the package is insufficient to ensure system integrity, as additional malicious software may persist. Immediate secret rotation from a separate device is advised to mitigate the impact.

Any system with this package installed or running is considered fully compromised, risking exposure of all stored secrets and keys. The malicious code may provide attackers with full control over the affected computer, leading to potential data theft, unauthorized access, and persistence of malicious software beyond the package itself.

Remove the @bc-workspace/utils package immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Because the system is fully compromised, consider rebuilding or thoroughly cleaning the affected machine to ensure removal of all malicious components. No official patch or fix is available; remediation relies on removal and secret rotation.