The 'player-theming' package in the npm ecosystem is identified as malicious software. Installation or execution of this package results in a full compromise of the host system. The malicious code likely grants attackers persistent control, making remediation difficult without comprehensive incident response. No CVSS score or detailed technical exploit information is provided, but the advisory strongly warns of complete system compromise and the need for secret/key rotation.

Any system with the 'player-theming' package installed or running should be considered fully compromised. Attackers may have gained full control over the system, potentially accessing or exfiltrating sensitive data including secrets and keys. The compromise may persist even after removal of the package, indicating possible additional malware or backdoors installed by the attacker.

Immediately remove the 'player-theming' package from all affected systems. Rotate all secrets and keys stored on compromised machines using a separate, trusted system. Conduct a thorough incident response to identify and eradicate any additional malicious software or backdoors. Because full control may have been given to attackers, consider rebuilding affected systems from known good backups.