The whs4_pnm npm package is identified as malicious software that, once installed or executed, fully compromises the host system. The compromise is severe enough that all stored credentials and keys must be considered exposed and rotated from a separate machine. Due to the potential for persistent malicious code beyond the package itself, simple removal of the package does not ensure complete remediation.

Full system compromise on any computer with the whs4_pnm package installed or running. All secrets and keys stored on the affected system are at risk and must be rotated. The malicious package may have installed additional malware, so the system cannot be trusted even after package removal.

Remove the whs4_pnm package immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Because the system may remain compromised beyond the presence of the package, consider rebuilding or thoroughly cleaning the affected machine. No official patch or fix is available; remediation relies on removal and credential rotation.