The polytrade package in the npm ecosystem has been identified as containing malicious code that grants full control of the infected computer to an outside entity. This level of compromise means that any sensitive information, including secrets and keys stored on the system, is at risk. The advisory warns that simply uninstalling the package may not remove all malicious components, indicating persistence mechanisms or additional payloads may be involved. There is no CVSS score or detailed technical vulnerability description available, but the severity is implied by the total system compromise statement.

Full system compromise on any computer with the polytrade package installed or running. Potential exposure and theft of all stored secrets and keys. Persistence of malicious software beyond removal of the package is possible, increasing the risk of ongoing unauthorized access.

Immediately remove the polytrade package from all affected systems. Rotate all secrets and keys that were stored on the compromised machines, performing this rotation from a separate, trusted computer. Conduct a thorough investigation and remediation of the affected systems, as removing the package alone may not eliminate all malicious software introduced. Consider rebuilding or restoring systems from known good backups to ensure full eradication of the compromise.