The @contentprod-authoring/block-manager npm package is identified as containing malicious code that compromises the host system completely. According to the source advisory, any system with this package installed should be considered fully compromised, with potential unauthorized access to all secrets and keys stored on that system. The advisory warns that simply removing the package may not remove all malicious artifacts, indicating persistent compromise. No CVSS score or detailed technical exploit information is provided. There is no indication of known exploits in the wild or available patches. The threat is specific to the npm ecosystem and the package named.

Full system compromise on any computer with the package installed or running. Potential exposure and theft of all stored secrets and keys. Persistent malicious presence may remain even after package removal, risking ongoing unauthorized access and control.

Remove the @contentprod-authoring/block-manager package immediately from all affected systems. Rotate all secrets and keys stored on the compromised systems from a separate, secure computer. Because full system compromise is possible, consider comprehensive incident response measures to ensure removal of all malicious software beyond just the package itself. No official patch or fix is available; remediation relies on removal and secret rotation.