The @grappi/automations package in the npm ecosystem is identified as containing malicious code that compromises the host system completely. According to the source details from the GHSA malware advisory, installation or execution of this package results in full system compromise, including exposure of stored secrets and keys. The advisory warns that simply removing the package may not remove all malicious artifacts or backdoors, indicating a deep level of compromise. No CVSS score or detailed technical vulnerability data is provided. There is no indication of known exploits in the wild or vendor patches.

Any system with the @grappi/automations package installed or running should be considered fully compromised. Attackers may have gained full control over the system, including access to sensitive credentials and secrets. This level of compromise can lead to data theft, unauthorized access, and further malicious activity. Because the malicious code may have established persistence, removing the package alone does not ensure remediation.

Immediate removal of the @grappi/automations package is recommended. All secrets, keys, and credentials stored on the affected system should be rotated from a separate, trusted device. Due to the potential for persistent compromise, a full system rebuild or forensic analysis is advised to ensure complete eradication of malicious code. No official patch or fix is available; remediation relies on removal and credential rotation.