The npm package [email protected] contains only two files and lacks behaviors commonly associated with supply-chain attacks, such as lifecycle scripts, network communications, credential access, or code execution primitives. Despite this, security sources classify the package as malicious, stating that any computer with this package installed should be considered fully compromised. The package name appears to be a random string, consistent with placeholder or throwaway publications. The advisory recommends immediate removal and rotation of all secrets and keys from a separate trusted system, noting that removal may not fully eradicate malicious software introduced by the package.

Installation of [email protected] results in a fully compromised system, potentially exposing all stored secrets and keys. The compromise is severe enough that simply removing the package may not restore system integrity, implying possible persistent or additional malicious components.

Remove the [email protected] package immediately. Rotate all secrets and keys stored on the compromised system from a different, trusted computer. Due to the potential for full system compromise, further forensic analysis and remediation may be necessary to ensure complete removal of malicious software.