The @img-hls/vtt.js package on npm has been identified as containing malicious code. Installation or execution of this package results in a full system compromise, potentially allowing an attacker complete control over the affected computer. Due to the severity of the compromise, all sensitive credentials on the system must be considered exposed and rotated from a secure environment. Removal of the package alone is insufficient to ensure system integrity, as additional malicious artifacts may persist.

Full compromise of any computer with the package installed or running. Exposure of all stored secrets and keys on the system. Potential persistent malicious presence beyond the package itself.

Remove the @img-hls/vtt.js package immediately. Rotate all secrets and keys stored on the affected computer from a separate, trusted machine. Conduct a thorough system investigation and remediation, as removing the package alone may not eliminate all malicious software introduced by it.