The 'competion' npm package versions 1.8.1, 1.8.2, 1.8.3, and 1.8.4 contain malicious code that, when installed or executed, can lead to a full compromise of the host system. This includes potential unauthorized control and access by attackers. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious components. The advisory recommends treating any affected system as fully compromised and rotating all secrets and keys from a different, secure system.

Any system with the affected versions of the 'competion' package installed or running should be considered fully compromised. Attackers may have gained full control over the system, risking exposure or theft of all stored secrets and keys. The presence of the malicious package can lead to persistent unauthorized access, and removal of the package alone may not restore system integrity.

Remove the affected 'competion' package versions 1.8.1 through 1.8.4 from all systems. Immediately rotate all secrets and keys stored on the compromised systems from a separate, secure computer. Because full system compromise is possible, consider rebuilding or thoroughly cleaning affected systems to ensure removal of all malicious components. Patch status is not confirmed; check vendor advisories for updates.