The 'lint-null' package version 1.0.4 distributed via npm contains embedded malicious code that, when installed or executed, results in a full system compromise. This means an attacker could gain complete control over the affected computer, potentially accessing or exfiltrating sensitive data such as secrets and keys. Due to the severity of the compromise, simply uninstalling the package may not fully remediate the infection, as additional malicious software could have been installed. The advisory recommends immediate rotation of all credentials from a secure environment and removal of the package.

Full system compromise on any computer with 'lint-null' version 1.0.4 installed or running. Potential exposure and theft of secrets and keys stored on the system. The attacker may maintain persistent access beyond the presence of the malicious package itself.

Remove the 'lint-null' package version 1.0.4 immediately from all affected systems. Rotate all secrets and keys that were stored on the compromised systems, performing this rotation from a separate, secure computer. Because full control may have been given to an attacker, consider a full system rebuild or forensic analysis to ensure complete removal of malicious components. No official patch or fix is available; the package itself is malicious.