The player-core-ui package in the npm ecosystem is identified as containing malicious code that compromises the host system completely. Installation or execution of this package results in full system compromise, granting attackers control over the machine and access to sensitive information such as secrets and keys. Due to the depth of compromise, simply uninstalling the package will not necessarily remove all malicious artifacts. The advisory recommends immediate secret/key rotation from a different, secure system and removal of the package to mitigate ongoing risk.

Full system compromise on any computer with the player-core-ui package installed or running. All secrets and keys stored on the compromised system are at risk and should be considered exposed. The attacker may maintain persistent access beyond the presence of the malicious package itself.

Remove the player-core-ui package immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components.