The 'chain-await-test' npm package version 1.3.5 is identified as containing malicious code that compromises the host system completely. According to the source advisory (GHSA-qvfh-cwr9-576c), installation or execution of this package results in full system compromise, potentially exposing all stored secrets and keys. The advisory warns that simply removing the package may not remove all malicious artifacts, indicating persistence mechanisms or additional payloads may be involved. No CVSS score or detailed technical exploit information is provided. No known exploits in the wild have been reported at this time.

Full system compromise on any computer with the affected package installed or running. All secrets and keys stored on the compromised system are at risk and should be considered exposed. The attacker may maintain persistence beyond package removal.

Remove the 'chain-await-test' package version 1.3.5 immediately. Rotate all secrets and keys from a different, secure computer to prevent unauthorized access. Because full system compromise is possible, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components. No official patch or fix is available; the package itself is malicious.