The wsh4_npm package is identified as malicious software within the npm ecosystem. Installation or execution of this package results in a full compromise of the affected system, potentially granting attackers complete control. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors. Immediate secret and key rotation from a different, secure system is advised to mitigate ongoing risk.

Full system compromise on any computer with the wsh4_npm package installed or running. All stored secrets and keys on the compromised system are at risk and should be considered exposed. The attacker may maintain persistent access even after package removal.

Remove the wsh4_npm package immediately. Rotate all secrets and keys stored on the compromised system using a separate, trusted computer. Because full system compromise is likely, consider rebuilding the affected system from a known good state to ensure complete removal of malicious software.