The npm package express-deflect is identified as containing malicious code that results in a full system compromise upon installation or execution. The malicious package can lead to complete attacker control over the affected computer, including potential access to sensitive secrets and keys. Due to the depth of compromise, simply uninstalling the package may not remove all malicious components. This threat is cataloged under MAL-2026-6908 and GHSA-968w-6262-r9f5 with no CVSS score assigned.

Any system with the express-deflect package installed or running should be considered fully compromised. Attackers may have gained full control over the system, potentially accessing or exfiltrating sensitive data such as secrets and keys. The integrity and confidentiality of the affected system cannot be assured. Removal of the package alone is insufficient to restore security.

Remove the express-deflect package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised machines, performing this rotation from a separate, secure system. Conduct a thorough investigation and remediation of the affected systems, as the presence of the malicious package indicates a full compromise and potential persistence of other malicious components. No official patch or fix is available; remediation relies on removal and system recovery procedures.