The 'alb-lambda-cdk' package in the npm ecosystem has been identified as containing malicious code. According to the source details, any system with this package installed should be considered fully compromised. The malicious code potentially grants full control to an attacker, risking exposure of all stored secrets and keys. Due to the severity of the compromise, simply uninstalling the package may not remove all malicious artifacts. The advisory recommends rotating all secrets and keys from a different, secure machine to mitigate ongoing risk.

Full system compromise on any machine with the package installed. Exposure and potential theft of all secrets and keys stored on the compromised system. Persistent malicious presence may remain even after package removal, leading to ongoing security risks.

Remove the 'alb-lambda-cdk' package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, secure computer. Because the system may be fully compromised, consider rebuilding or restoring systems from known good backups to ensure removal of all malicious software.