The 'log-upgrade' npm package at version 7.1.0 is identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker to gain complete control. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts. The advisory recommends treating any affected system as fully compromised and rotating all credentials from a separate, secure system.

Any system with 'log-upgrade' version 7.1.0 installed or running should be considered fully compromised. Attackers may have gained full control over the system, risking exposure and theft of all stored secrets and keys. The presence of this malicious package undermines system integrity and confidentiality.

Remove the 'log-upgrade' package version 7.1.0 immediately. Rotate all secrets and keys stored on the affected system from a different, secure computer. Because full system compromise is likely, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components. No official patch or fix is available; remediation relies on removal and credential rotation.