The @node-cloud/create package in the npm ecosystem has been identified as containing malicious code. Installation or execution of this package results in a full system compromise, potentially allowing an attacker complete control over the affected computer. Due to the severity of the compromise, all credentials and secrets stored on the system are considered exposed and must be rotated from a secure environment. Removal of the package alone is insufficient to ensure system integrity, as additional malicious components may persist.

Full system compromise on any computer with the package installed or running. Exposure of all stored secrets and keys on the affected system. Potential persistent malicious software beyond the package itself.

Remove the @node-cloud/create package immediately. Rotate all secrets and keys stored on the affected computer from a separate, trusted machine. Conduct a thorough system investigation and remediation, as removing the package alone may not eliminate all malicious software introduced by it.