The @lodash-en/lodash-en package on npm has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the affected system, potentially allowing an attacker to gain complete control. Due to the severity of the compromise, all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Simply uninstalling the package is insufficient to ensure removal of all malicious artifacts introduced by the package.

Any system with the @lodash-en/lodash-en package installed or running should be considered fully compromised. Attackers may have gained full control over the system, putting all stored secrets and keys at risk. This can lead to unauthorized access, data theft, and further malicious activity. The compromise is severe and remediation requires more than just package removal.

Remove the @lodash-en/lodash-en package immediately. Rotate all secrets and keys stored on the compromised system from a different, trusted computer. Because the system is fully compromised, consider rebuilding or thoroughly cleaning the affected machine to ensure all malicious software is removed. There is no official patch or fix; remediation relies on removal and secret rotation.