The 'caldryn' package in the npm ecosystem is identified as containing malicious code. According to the source advisory, any system with this package installed should be considered fully compromised. Attackers may have gained complete control, potentially exfiltrating secrets and keys. Removal of the package alone is insufficient to ensure system integrity due to possible persistent backdoors or additional malware installed alongside. Immediate secret/key rotation from a secure environment is recommended.

Full compromise of affected systems is indicated. Attackers may have access to all stored secrets and keys, leading to potential data breaches, unauthorized access, and further system exploitation. The threat extends beyond the package itself due to possible persistent malicious software installed during the compromise.

Remove the 'caldryn' package immediately. Rotate all secrets and keys from a different, uncompromised system. Conduct a thorough investigation and remediation of the affected system, as removal of the package alone does not guarantee elimination of all malicious components. No official patch or fix is available; remediation relies on incident response and secret/key rotation.