The 'rnx-align-deps' package in the npm ecosystem has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the affected computer. Due to the severity of the compromise, attackers may have obtained control beyond the package itself, potentially installing additional malicious software. The advisory strongly recommends rotating all secrets and keys from a separate, uncompromised system. No patch or fix is available for the package itself, and removal alone is insufficient to ensure system security.

Any system with the 'rnx-align-deps' package installed or running should be considered fully compromised. Attackers may have gained full control over the system, risking exposure and theft of all stored secrets and keys. The compromise extends beyond the package, potentially including persistent malicious software. This represents a critical security breach with severe confidentiality, integrity, and availability implications.

Remove the 'rnx-align-deps' package immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted computer. Because the attacker may have installed additional malicious software, consider the affected system untrusted and perform a full forensic analysis or system rebuild. No official patch or fix is available for this malicious package; prevention by avoiding installation is critical.