The @hg-aka-prml/tapas-common npm package is identified as containing malicious code that compromises the host system completely. Installation or execution of this package can lead to full system compromise, including unauthorized access and control by an attacker. Due to the nature of the compromise, simply uninstalling the package does not guarantee removal of all malicious artifacts. Immediate secret and key rotation from a separate, secure environment is strongly advised to mitigate ongoing risks.

Systems with this package installed or running are considered fully compromised, potentially allowing attackers full control over the affected computer. All stored secrets and keys on the compromised system are at risk and should be rotated immediately. The malicious code may persist beyond removal of the package, indicating a deep and persistent compromise.

Remove the @hg-aka-prml/tapas-common package immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Because full system compromise is possible, consider rebuilding the affected system from a known good backup or reinstalling the operating system to ensure complete removal of malicious components.