The 'procwire' package in the npm ecosystem is identified as containing malicious code that results in a full compromise of the host system. According to the source advisory, any system with this package installed or running should be considered fully compromised, implying that attackers may have gained extensive control. The advisory strongly recommends rotating all secrets and keys from a separate, uncompromised machine. Due to the potential persistence of malicious software beyond the package itself, simple removal of 'procwire' is insufficient to fully remediate the threat.

Full system compromise on any computer with the 'procwire' package installed or executed. This includes potential unauthorized access to all stored secrets and keys, which must be considered compromised and rotated immediately. The presence of this package may lead to persistent malicious software beyond the package itself, posing a significant security risk.

Immediate removal of the 'procwire' package is recommended. However, because the system is considered fully compromised, all secrets and keys stored on the affected machine should be rotated from a separate, trusted device. Additional remediation steps may be necessary to detect and remove any persistent malicious software introduced by the package. No official patch or fix is available; remediation relies on removal and secret rotation.