The nodemon-node npm package is identified as containing malicious code that results in full system compromise upon installation or execution. The compromise extends to all stored secrets and keys, which must be considered exposed. Due to the nature of the compromise, simply uninstalling the package does not ensure removal of all malicious artifacts or backdoors. This threat is cataloged under MAL-2026-6957 and GHSA-58j3-rgh4-9rjc, with no CVSS score assigned. No patch or fix is available, and the package should be removed immediately.

Any system with the nodemon-node package installed or running is fully compromised, risking exposure of all stored secrets and keys. The attacker may have persistent control beyond the presence of the package itself, making the system untrustworthy until fully remediated.

Remove the nodemon-node package immediately. Rotate all secrets and keys from a separate, uncompromised system to prevent unauthorized access. Because full control may have been granted to an attacker, consider rebuilding or thoroughly cleaning the affected system. No official patch or fix is available; avoidance and removal are the only mitigations.