The @whs4/whs4_npm package is identified as containing malicious code that, once installed, fully compromises the host system. This compromise allows an attacker to gain control over the affected computer. Due to the severity of the compromise, all sensitive credentials and keys stored on the system must be rotated from a different, secure machine. The package removal is necessary but insufficient to ensure complete remediation, as additional malicious artifacts may persist.

Any system with the @whs4/whs4_npm package installed or running is considered fully compromised, potentially exposing all stored secrets and keys. This level of compromise can lead to unauthorized access, data theft, and further malicious activity on the affected machine.

Remove the @whs4/whs4_npm package immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure computer. Because the system may be fully compromised, consider rebuilding the affected machine to ensure complete removal of malicious software.