The 'whs4_npm' package in the npm ecosystem is identified as containing malicious code that compromises the host system completely. According to the source advisory, any system with this package installed should be considered fully compromised, with potential unauthorized control by an outside entity. The advisory warns that simply removing the package may not remove all malicious components. There is no CVSS score or detailed technical exploit information available. No known exploits in the wild have been reported. No patch or remediation is indicated, and no affected versions are specified.

Complete compromise of the affected computer, including potential unauthorized access and control. All secrets and keys stored on the compromised system are at risk and must be rotated. Removal of the package alone may not restore system integrity.

Remove the 'whs4_npm' package immediately from affected systems. Rotate all secrets, keys, and credentials stored on the compromised computer from a separate, trusted system. Because full control may have been given to an attacker, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components. No official patch or fix is available.