The 'auth-state-service' npm package is identified as malicious. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker complete control. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors. This threat is documented under MAL-2026-6655 and GHSA-53ph-27qg-w52c. No CVSS score or detailed technical exploit information is provided.

Any system with this package installed or running should be considered fully compromised. Attackers may have gained full control, risking exposure and theft of all secrets and keys stored on the system. The integrity and confidentiality of the affected system are severely impacted.

Remove the 'auth-state-service' package immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted computer. Because full system compromise is likely, consider rebuilding the affected system from a clean state to ensure removal of all malicious components. No official patch or fix is available; remediation relies on removal and secret rotation.