The npm package @reference-web/pmp-i18n has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host computer, potentially allowing attackers to control the system and access sensitive information such as secrets and keys. Due to the nature of the compromise, simply removing the package may not eradicate all malicious components. This threat is catalogued under MAL-2026-6643 and GHSA-m6f5-jgw6-8m97. No CVSS score or patch information is available, and no known exploits in the wild have been reported at this time.

Full system compromise on any computer with the package installed or running. Potential exposure and theft of all stored secrets and keys. Persistent malicious presence may remain even after package removal.

Remove the @reference-web/pmp-i18n package immediately. Rotate all secrets and keys that were stored on the compromised computer, performing this rotation from a different, secure machine. Because full control may have been given to an attacker, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious software. No official patch or fix is available; remediation relies on removal and secret rotation.