The vite-json-pwa npm package is identified as containing malicious code that fully compromises affected systems. Installation or execution of this package grants an attacker full control over the computer, potentially exposing all stored secrets and keys. Due to the severity of the compromise, simply uninstalling the package is insufficient to ensure system integrity, as additional malicious software may persist.

Full system compromise on any computer with the vite-json-pwa package installed or running. All secrets and keys stored on the compromised system are at risk and must be rotated immediately from a different, secure machine. The attacker may maintain persistent access beyond the presence of the package itself.

Remove the vite-json-pwa package immediately. Rotate all secrets and keys from a separate, uncompromised computer. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components. No official patch or fix is available; remediation relies on removal and secret rotation.