The duration-kit package in the npm ecosystem is identified as containing malicious code. Installation or execution of this package results in a full compromise of the host computer. The malicious code potentially grants an outside entity full control over the system, risking exposure of all stored secrets and keys. Due to the severity of the compromise, remediation requires secret rotation from a separate trusted environment and removal of the package, although removal may not fully eradicate the attacker presence.

Full system compromise on any computer with the duration-kit package installed or running. All secrets and keys stored on the compromised system are at risk and must be rotated. The attacker may maintain persistence beyond simple package removal.

Remove the duration-kit package immediately. Rotate all secrets and keys from a different, uncompromised computer. Because the attacker may have established persistent control, additional forensic analysis and system restoration may be necessary to ensure full remediation.