The package '@citi-icg-171632/citicms-repo-component' at version 99.9.1 is flagged as malicious by the OpenSSF Package Analysis project and the GHSA malware database. It is considered malicious because it communicates with a domain associated with malicious activity. The presence of this package on a system implies a full compromise, potentially allowing an attacker full control over the affected computer. Immediate secret and key rotation from a separate trusted environment is recommended. There is no patch or fix available for this package; remediation involves removal and incident response.

Systems with this package installed or running are considered fully compromised. Attackers may have gained full control, risking exposure of all secrets and keys stored on the system. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the package.

Remove the '@citi-icg-171632/citicms-repo-component' package immediately. Rotate all secrets and keys stored on the affected system from a different, trusted computer. Conduct a thorough incident response as the system may remain compromised even after package removal. No official patch or fix is available; remediation relies on removal and recovery procedures.