The 'whs4_npm_test' package in the npm ecosystem is identified as malicious software. Installation or execution of this package results in full compromise of the host system, potentially allowing an attacker complete control. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors. The advisory recommends treating any affected system as fully compromised and rotating all credentials from a secure environment.

Full system compromise on any computer with the package installed or running. All secrets and keys stored on the compromised system are at risk and should be considered exposed. The persistence of malicious code beyond package removal means ongoing risk even after uninstalling the package.

Remove the 'whs4_npm_test' package immediately. Rotate all secrets, keys, and credentials stored on the affected system from a different, secure computer. Because full control may have been given to an attacker, consider the affected system untrusted and perform a full system rebuild or forensic analysis to ensure removal of all malicious components. No official patch or fix is available; remediation relies on removal and credential rotation.