The '@partner-apps/ui' package in the npm ecosystem is identified as containing malicious code that grants full control over the infected computer to an attacker. This level of compromise implies that the attacker can access all sensitive information and potentially maintain persistent access. The advisory warns that simply uninstalling the package does not guarantee removal of all malicious components, indicating possible secondary payloads or backdoors installed alongside the package.

Any system with the '@partner-apps/ui' package installed or running is considered fully compromised. This includes potential exposure and theft of all stored secrets and keys. The attacker may have persistent control over the system, leading to a complete breach of confidentiality, integrity, and availability of the affected environment.

Immediate removal of the '@partner-apps/ui' package is recommended. However, because the system is likely fully compromised, all secrets and keys stored on the machine must be rotated immediately from a separate, trusted device. Further forensic analysis and system restoration from a known good backup are advised to ensure complete eradication of malicious software. No official patch or fix is available; remediation relies on removal and secret rotation.