The nbmolviz-js package distributed via npm is identified as containing malicious code that results in a full system compromise upon installation or execution. This malicious package can lead to unauthorized control over the affected computer, exposing all stored secrets and keys. Due to the nature of the compromise, remediation requires not only removal of the package but also rotation of all credentials from a separate secure environment. There is no indication of a patch or fix since this is a case of a malicious package rather than a software vulnerability. No CVSS score is assigned, and no known exploits in the wild are reported at this time.

Any system with the nbmolviz-js package installed or running is considered fully compromised. Attackers may have gained complete control, leading to exposure of all stored secrets and keys. The compromise may persist even after removal of the package, indicating potential installation of additional malicious software or backdoors.

Remove the nbmolviz-js package immediately from all affected systems. Rotate all secrets, keys, and credentials from a different, trusted computer to prevent further unauthorized access. Because the system may remain compromised even after package removal, consider rebuilding or thoroughly cleaning affected systems to ensure complete eradication of malicious components.