The 'npm-doc-dev' package, specifically versions =1.0.4, =1.0.5, =1.0.6, =1.0.7, =1.0.8, =1.0.9, =1.1.0, and =1.1.1, contains malicious code that results in a full system compromise upon installation or execution. This malicious package can lead to an attacker gaining complete control over the affected computer. Due to the severity of the compromise, simply uninstalling the package may not remove all malicious artifacts. Immediate rotation of all secrets and keys stored on the compromised system is recommended, using a different, uncompromised machine.

Any system with the affected versions of 'npm-doc-dev' installed or running should be considered fully compromised. Attackers may have obtained full control of the system, potentially accessing or exfiltrating sensitive data including secrets and keys. The compromise is severe enough that removal of the package alone is insufficient to ensure system integrity.

Remove the 'npm-doc-dev' package immediately from affected systems. Rotate all secrets and keys stored on the compromised computer using a separate, secure device. Because full system compromise is possible, consider rebuilding or thoroughly cleaning the affected system. No official patch or fix is indicated; remediation relies on removal and secret rotation.