The @rakuten-rewards/messaging-sdk-js package on npm has been identified as containing malicious code that compromises the host system completely. According to the source details, any computer with this package installed should be considered fully compromised, necessitating immediate secret and key rotation from a different machine. The package removal does not ensure full remediation due to potential persistence of malicious components.

Full system compromise on any computer with the package installed or running. All secrets and keys stored on the compromised system are at risk and must be rotated immediately. The presence of the package implies potential ongoing malicious control beyond just the package itself.

Remove the @rakuten-rewards/messaging-sdk-js package immediately. Rotate all secrets and keys from a separate, uncompromised device. Because the system is considered fully compromised, further forensic analysis and remediation may be necessary. No official patch or fix is available; the package itself is malicious.