The 'secure-box' npm package versions 1.0.1 and 1.0.2 have been identified as containing malicious code. Installation or execution of these versions results in a full compromise of the host computer, potentially exposing all stored secrets and keys. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors introduced. Immediate rotation of all secrets and keys from a separate, trusted system is advised.

Systems with 'secure-box' versions 1.0.1 or 1.0.2 installed or running are fully compromised, risking exposure of all stored secrets and keys. The attacker may have persistent access beyond the presence of the package itself, making remediation difficult without comprehensive incident response.

Remove the 'secure-box' package versions 1.0.1 and 1.0.2 immediately. Rotate all secrets and keys from a different, secure computer to prevent unauthorized access. Conduct a thorough security assessment and incident response, as removal of the package alone may not eliminate all malicious software introduced.