The '@gm-rvg/root-config' package distributed via npm is identified as malicious. Installation or execution of this package results in a complete compromise of the affected system, potentially allowing an attacker full control. Due to the severity of the compromise, all stored secrets and keys on the affected machine must be rotated from a different, uncompromised system. Removal of the package alone is insufficient to ensure system integrity, as additional malicious components may persist.

Any system with this package installed or running should be considered fully compromised. Attackers may have gained full control, exposing all stored secrets and keys. This level of compromise poses a critical risk to confidentiality, integrity, and availability of the affected system and any connected resources.

Remove the '@gm-rvg/root-config' package immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure computer. Due to the likelihood of persistent malicious software beyond the package itself, consider rebuilding or thoroughly cleaning the affected system to restore trustworthiness.