The 'quoting' package in the npm ecosystem is identified as containing malicious code that compromises the host system completely. According to the source details, any system with this package installed or running should be considered fully compromised, with attacker control potentially extending beyond the package itself. The advisory warns that simply removing the package may not remove all malicious components introduced by the attacker. There is no CVSS score or detailed technical vulnerability description available. No patch or remediation is indicated other than removal and secret rotation.

Full system compromise on any computer with the 'quoting' package installed or running. All secrets and keys stored on the compromised system are at risk and must be rotated immediately. Persistent malicious presence may remain even after package removal.

Remove the 'quoting' package immediately from all affected systems. Rotate all secrets and keys from a different, uncompromised computer. Because full control may have been given to an attacker, consider rebuilding or thoroughly cleaning affected systems to ensure removal of all malicious software. No official patch or fix is available.