The 'na-rony' package in the npm ecosystem is identified as containing malicious code that fully compromises any system where it is installed or executed. This compromise extends to all secrets and keys stored on the system, necessitating their immediate rotation from a secure environment. Due to the potential for persistent malicious software beyond the package itself, simply uninstalling 'na-rony' does not ensure full remediation of the infection.

Full system compromise on any computer with the 'na-rony' package installed or running. All stored secrets and keys on the affected system are at risk and should be considered compromised. The presence of this package may allow an attacker to maintain persistent access beyond the package removal.

Remove the 'na-rony' package immediately. Rotate all secrets and keys stored on the affected system from a different, trusted computer. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected machine to ensure removal of all malicious components. No official patch or fix is available; remediation relies on removal and secret rotation.