The 'cmp-api-stub' npm package is identified as malicious software. According to the source details, any system with this package installed should be considered fully compromised. Attackers may have gained full control over the affected computer, potentially accessing all stored secrets and keys. Immediate rotation of all credentials from a separate, secure machine is recommended. The package removal is advised but may not guarantee complete eradication of the malicious software introduced by the package.

Full system compromise on any computer with the 'cmp-api-stub' package installed or running. All secrets and keys stored on the compromised machine are at risk and should be considered exposed. The attacker may maintain persistent access beyond the presence of the package itself.

Remove the 'cmp-api-stub' package immediately. Rotate all secrets and keys from a different, secure computer to prevent unauthorized access. Because the system may be fully compromised, consider a full system rebuild or forensic analysis to ensure complete removal of malicious components. No official patch or fix is available; remediation relies on removal and credential rotation.