The 'pinokio-redis' npm package is identified as malicious software that, when installed or executed, can fully compromise the host computer. This compromise includes potential unauthorized access to sensitive information such as secrets and keys. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious components or backdoors established by the attacker. The threat is classified as a malicious package rather than a conventional vulnerability and does not have a CVSS score. No known exploits in the wild are reported at this time.

Any system with 'pinokio-redis' installed or running should be considered fully compromised. Attackers may have gained full control over the system, including access to all stored secrets and keys. This level of compromise poses a significant risk to confidentiality, integrity, and availability of the affected system and any connected resources.

Remove the 'pinokio-redis' package immediately from all affected systems. Rotate all secrets and keys that were stored on the compromised machines from a separate, trusted computer. Because full system compromise is possible, further forensic analysis and remediation may be necessary to ensure all malicious artifacts are removed. No official patch or fix is available since this is a malicious package rather than a software vulnerability.