The decode-sdks npm package is identified as malicious software that, when installed or executed, fully compromises the host system. This compromise potentially grants an attacker complete control over the affected computer. Due to the severity of the compromise, all sensitive credentials stored on the system should be considered exposed and must be rotated immediately from a different, uncompromised device. Removal of the decode-sdks package alone is insufficient to ensure system integrity, as additional malicious components may persist.

Any system with the decode-sdks package installed or running is considered fully compromised, with attacker control possible. All secrets and keys stored on the system are at risk and should be rotated immediately. The compromise may persist beyond the presence of the package itself, indicating a deep and persistent infection.

Remove the decode-sdks package immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure computer. Because full system compromise is likely, consider rebuilding the affected system from a trusted backup or reinstalling the operating system to ensure complete removal of malicious software.