The wime-zle package version 1.1.4 distributed via npm is identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing attackers to access sensitive information such as secrets and keys. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors introduced. Immediate rotation of all secrets and keys from a separate, trusted system is advised to mitigate the impact.

Full system compromise on any computer with the wime-zle 1.1.4 package installed or running. Attackers may gain access to all stored secrets and keys, leading to potential data breaches and further unauthorized actions. The persistence of malicious software beyond package removal increases the risk and complexity of remediation.

Remove the wime-zle package version 1.1.4 immediately from affected systems. Rotate all secrets and keys stored on compromised computers using a different, secure system. Because the attacker may have established persistent control, consider rebuilding the affected systems from a known good state to ensure complete eradication of malicious software. No official patch or fix is available; remediation relies on removal and secret rotation.