The brock-react-alerts package on npm is identified as containing malicious code that can fully compromise a host system. According to the source advisory, any system with this package installed should be considered fully compromised, necessitating immediate rotation of all secrets and keys from a separate, secure machine. The advisory warns that simply uninstalling the package does not guarantee removal of all malicious software introduced by it. There is no CVSS score or detailed technical vulnerability description available. No patch or remediation is provided, and the package is not a cloud service.

Full compromise of the affected computer, including potential unauthorized access to all stored secrets and keys. The malicious package may install additional persistent malware, making removal difficult and increasing the risk of ongoing unauthorized access.

Remove the brock-react-alerts package immediately from all affected systems. Rotate all secrets and keys from a different, uncompromised computer to prevent misuse. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected machines to ensure removal of all malicious components. No official patch or fix is available.