The 'setup-cicd' package in the npm ecosystem is identified as malicious. Any system with this package installed or running should be considered fully compromised. The malicious code may provide attackers with full control over the affected computer. Due to the potential persistence mechanisms, simply uninstalling the package may not remove all malicious components. Consequently, all sensitive credentials stored on the system should be rotated immediately from a different, uncompromised machine to prevent further unauthorized access.

Full system compromise on any computer with the 'setup-cicd' package installed or running. All secrets and keys stored on the compromised computer are at risk and should be considered exposed. Removal of the package alone does not guarantee removal of all malicious artifacts, indicating potential persistence and ongoing risk.

Remove the 'setup-cicd' package immediately from affected systems. Consider the system fully compromised and rotate all secrets and keys from a separate, trusted computer. Because removal of the package may not eliminate all malicious software, further forensic analysis and system remediation may be necessary.