The rma-utils npm package version 1.0.1 is identified as containing malicious code that fully compromises affected systems. Installation or execution of this package grants an attacker full control over the compromised computer. Due to the severity of the compromise, all stored secrets and keys must be rotated immediately from a different, secure device. Removal of the package alone is insufficient to ensure complete remediation, as additional malicious components may persist.

Systems with rma-utils version 1.0.1 installed or running are considered fully compromised, potentially exposing all stored secrets and keys. Attackers may have complete control over the affected computer, leading to severe confidentiality, integrity, and availability risks. The compromise extends beyond the package itself, as malicious software introduced may remain even after package removal.

Remove the rma-utils package version 1.0.1 immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, secure computer. Due to the full system compromise, consider rebuilding or thoroughly cleaning affected systems to ensure removal of all malicious software. No official patch or fix is available; remediation relies on removal and secret rotation.