The postcss-property-rollup package distributed via npm is identified as containing malicious code that fully compromises affected systems. Installation or execution of this package results in complete control by an attacker, potentially exposing all stored secrets and keys. Due to the severity of the compromise, remediation involves rotating credentials from a different, uncompromised system and removing the package, although full cleanup cannot be assured. No patch or official fix is available as this is a malicious package rather than a vulnerability in legitimate software.

Systems with the postcss-property-rollup package installed or running are considered fully compromised. Attackers may have gained full control, risking exposure and theft of all stored secrets and keys. The compromise may persist even after package removal due to potential additional malicious software installed.

Remove the postcss-property-rollup package immediately. Rotate all secrets and keys from a separate, uncompromised computer. Because the system is fully compromised, consider rebuilding or thoroughly cleaning the affected machine. No official patch or fix exists as this is a malicious package. Monitor for any signs of persistent malicious activity.