The app-hotmart-blog-headless npm package is identified as containing malicious code that compromises the host system completely. According to the source advisory, any computer with this package installed should be considered fully compromised, with potential unauthorized access to all stored secrets and keys. The advisory warns that simply removing the package may not remove all malicious artifacts, indicating persistent or additional malware may have been installed. No CVSS score or detailed technical exploit information is provided. No patch or remediation is indicated beyond removal and secret rotation.

Full system compromise on any computer with the package installed or running. Potential exposure and theft of all secrets and keys stored on the system. Persistent malicious code may remain even after package removal, risking ongoing unauthorized access and control.

Remove the app-hotmart-blog-headless package immediately from all affected systems. Rotate all secrets and keys stored on the compromised machines using a separate, secure device. Because full system compromise is possible, consider rebuilding or thoroughly cleaning affected systems to ensure removal of all malicious software. No official patch or fix is available; remediation relies on removal and secret rotation.