The npm package chai-spycore is identified as containing malicious code that compromises the host system completely. According to the source advisory, any system with this package installed should be considered fully compromised, with potential unauthorized control by an outside entity. The advisory warns that simply removing the package may not remove all malicious artifacts, and all secrets and keys stored on the compromised system must be rotated from a separate, secure computer.

Full system compromise on any computer with the package installed or running. Potential unauthorized access to all secrets and keys stored on the system. Persistence of malicious software beyond removal of the package is possible.

Remove the chai-spycore package immediately. Rotate all secrets and keys stored on the affected computer from a different, secure device. Consider the affected system fully compromised and perform a thorough investigation and remediation beyond package removal.