The @concerns/i18n package on npm is identified as malicious software. Installation or execution of this package results in full compromise of the host system, potentially allowing an attacker complete control. Due to the nature of the compromise, simply removing the package may not eradicate all malicious components introduced. This threat is cataloged under MAL-2026-6606 and has no CVSS score assigned.

Full system compromise on any computer with the @concerns/i18n package installed or running. All secrets and keys stored on the system are at risk and should be considered compromised. The attacker may have persistent access beyond the presence of the package itself.

Remove the @concerns/i18n package immediately. Rotate all secrets and keys from a different, uncompromised system. Because full control of the computer may have been given to an attacker, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious software.