The @cseo-hr/trpweb-shared package distributed via npm is identified as containing malicious code. According to the source details, any system with this package installed should be considered fully compromised. The attacker may have gained full control over the system, potentially accessing sensitive information such as secrets and keys. Because of this, simply uninstalling the package does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

Systems with the @cseo-hr/trpweb-shared package installed are at risk of complete compromise. Attackers may have full control over the affected computer, including access to stored secrets and keys. This can lead to unauthorized data access, credential theft, and further system manipulation. The compromise may persist even after removal of the package due to potential additional malicious software installed.

Immediate removal of the @cseo-hr/trpweb-shared package is recommended. However, because the system may be fully compromised, all secrets and keys stored on the affected computer should be rotated from a separate, trusted machine. Comprehensive incident response and system remediation should be conducted to ensure removal of all malicious components. No official patch or fix is available; mitigation relies on removal and credential rotation.