The @lexisnexisrisk/insider-threat-platform npm package has been identified as containing malicious code that compromises the host system completely. According to the source details, installation or execution of this package results in full system compromise, potentially allowing an attacker to access all stored secrets and keys. Due to the depth of the compromise, simple removal of the package is insufficient to guarantee eradication of the malicious software or attacker access. No CVSS score or detailed technical exploit information is provided. There is no indication of known exploits in the wild or vendor patches.

Any system with this package installed or running should be considered fully compromised. Attackers may have gained full control, including access to all stored secrets and keys. This level of compromise poses a critical risk to confidentiality, integrity, and availability of the affected system and any connected networks or services relying on it.

Remove the @lexisnexisrisk/insider-threat-platform package immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted computer. Because full control may have been given to an attacker, consider the system untrusted and perform a full forensic analysis and system rebuild as necessary. No official patch or fix is available; remediation relies on removal and credential rotation.