The @deel-ui/animation package on npm has been identified as containing malicious code that compromises the host system completely. According to the source advisory, installation or execution of this package results in full system compromise, potentially allowing an attacker full control. Due to the severity of the compromise, secrets and keys stored on the affected system must be rotated from a separate, secure environment. Removal of the package is necessary but insufficient to fully remediate the infection, as additional malicious software may persist.

Full compromise of any computer with the package installed or running. Potential exposure and theft of all secrets and keys stored on the system. The attacker may have persistent control beyond the presence of the package itself.

Immediately remove the @deel-ui/animation package from all affected systems. Rotate all secrets and keys stored on the compromised machines from a different, secure computer. Conduct a thorough investigation and remediation of the affected systems, as removing the package alone does not guarantee elimination of all malicious components.