The npm package [email protected] is flagged as malicious. Source analysis from Amazon Inspector found no static or behavioral indicators of common malware actions, but the package's unusual name and external intelligence from GHSA-malware indicate that any system with this package installed should be treated as fully compromised. The package may have granted an attacker full control, and simply removing it does not guarantee removal of all malicious artifacts. Immediate secret and key rotation from a separate system is advised.

Systems with [email protected] installed or running are considered fully compromised. Attackers may have obtained full control, risking exposure of all stored secrets and keys. Removal of the package does not ensure elimination of all malicious software introduced by it.

Remove the chmjdsidwlf5 package immediately. Rotate all secrets and keys stored on the affected system from a different, trusted computer. Due to potential full system compromise, consider rebuilding the affected system to ensure complete remediation.