The @services-lib/application-http-client npm package has been identified as containing malicious code that results in a full system compromise upon installation or execution. This malicious package can lead to unauthorized control over the affected computer, potentially exposing all stored secrets and keys. The advisory warns that removal of the package alone does not guarantee eradication of all malicious components introduced by the package.

Any system with this package installed or running should be considered fully compromised. Attackers may have gained complete control over the system, risking exposure and theft of all stored secrets and keys. The compromise is severe enough that remediation requires key and secret rotation from a different, uncompromised system. The presence of this package represents a critical security risk.

Remove the @services-lib/application-http-client package immediately. Rotate all secrets and keys stored on the compromised system using a separate, secure computer. Because full control may have been given to an attacker, further forensic analysis and remediation may be necessary beyond package removal. Patch status is not applicable as this is a malicious package rather than a vulnerability with a vendor fix.