The @gallup/pc-utils npm package is identified as malicious software that, once installed or executed, results in full compromise of the host system. This includes potential unauthorized access and control by an external entity. Due to the severity of the compromise, simply uninstalling the package may not remove all malicious components. The advisory recommends immediate secret and key rotation from a separate, uncompromised system to mitigate ongoing risk.

Full system compromise on any computer with the package installed or running. Potential exposure and theft of all stored secrets and keys. Persistence of malicious software beyond package removal is likely, increasing risk of ongoing unauthorized access.

Remove the @gallup/pc-utils package immediately. Rotate all secrets and keys stored on the affected computer from a different, secure system. Because full system compromise is likely, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components. No official patch or fix is available; remediation relies on removal and secret rotation.