The devkit-scripts package for npm in versions 1.0.0 and 1.0.3 contains embedded malicious code that compromises any computer on which it is installed or executed. The compromise is severe enough that the entire system's security is undermined, necessitating secret and key rotation from a different machine. Due to the potential for persistent malicious presence beyond the package itself, simple removal of the package does not ensure remediation.

Systems with devkit-scripts versions 1.0.0 or 1.0.3 installed are fully compromised, potentially allowing attackers complete control. All sensitive information such as secrets and keys stored on the affected system may be exposed and must be rotated immediately. The presence of the malicious package indicates a high risk of persistent malicious software beyond the package itself.

Remove the devkit-scripts package versions 1.0.0 and 1.0.3 from affected systems. Immediately rotate all secrets and keys stored on the compromised system using a separate, secure computer. Because full control may have been granted to attackers, consider a full system rebuild or forensic analysis to ensure complete removal of malicious software. Patch status is not applicable as this is a malicious package rather than a vulnerability with a vendor fix.