The @shopbop/api-models package distributed via npm is identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, allowing attackers to gain control and access sensitive information such as secrets and keys. Due to the nature of the compromise, simply uninstalling the package is insufficient to ensure system integrity, as attackers may have deployed additional malware or backdoors.

Any system with the @shopbop/api-models package installed or running is considered fully compromised. Attackers may have access to all secrets and keys stored on the system, posing a severe risk to confidentiality and system integrity. The compromise may persist beyond removal of the package, indicating potential for ongoing unauthorized access.

Remove the @shopbop/api-models package immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted computer. Due to the likelihood of persistent compromise, consider rebuilding or fully restoring the affected system from a known good backup to ensure removal of all malicious components.