The 'pvd3' package in the npm ecosystem is identified as containing malicious code that compromises the host system completely. According to the source advisory, any system with this package installed should be considered fully compromised, with potential unauthorized control by an external entity. The advisory warns that simply removing the package may not remove all malicious artifacts. No CVSS score or detailed technical exploit information is provided.

Full compromise of the affected computer, including potential unauthorized access and control. All secrets and keys stored on the system are at risk and should be rotated immediately. The presence of the package indicates a high likelihood of persistent malicious software beyond the package itself.

Remove the 'pvd3' package immediately from all affected systems. Rotate all secrets, keys, and credentials stored on the compromised computer from a different, secure system. Because full compromise is likely, consider rebuilding the affected system to ensure removal of all malicious components. No official patch or fix is available; remediation relies on removal and credential rotation.