The whs4_nmp npm package is identified as containing malicious code that fully compromises affected computers. Installation or execution of this package results in a complete system compromise, potentially allowing attackers to access all stored secrets and keys. Due to the nature of the compromise, simply uninstalling the package is insufficient to ensure system integrity, as attackers may have installed additional persistent malicious components.

Any system with the whs4_nmp package installed or running should be considered fully compromised. Attackers may have gained full control over the system, exposing all stored secrets and keys. This level of compromise poses a critical risk to confidentiality, integrity, and availability of the affected system and any connected resources.

Immediate removal of the whs4_nmp package is recommended. However, because the system may be fully compromised, all secrets and keys stored on the affected computer must be rotated from a separate, trusted machine. Additional forensic analysis and system restoration or reimaging may be necessary to ensure complete removal of malicious software.