The db-convertor npm package has been identified as containing malicious code that fully compromises the host computer. Installation or execution of this package grants an attacker potential full control over the system. Due to the nature of the compromise, secrets and keys stored on the affected machine are at risk and must be rotated from a secure environment. The package removal does not guarantee complete eradication of the malicious presence, indicating possible persistence mechanisms have been employed by the attacker.

Full system compromise on any computer with the db-convertor package installed or running. Potential exposure and theft of all stored secrets and keys. The attacker may maintain persistent access even after package removal, leading to ongoing risk.

Immediately remove the db-convertor package from all affected systems. Rotate all secrets and keys stored on the compromised machines from a separate, secure computer. Conduct a thorough investigation and remediation to detect and remove any persistent malicious components beyond the package itself. No official patch or fix is available; remediation relies on removal and secret rotation.