The express-security-policy npm package was found to include malicious code embedded in its preinstall script. This code exfiltrates sensitive user and host information to a remote server while employing obfuscation techniques, delayed execution, and error suppression to avoid detection. The compromise is severe enough that any system with this package installed is considered fully compromised, necessitating immediate secret/key rotation and comprehensive remediation beyond simple package removal.

Systems with the express-security-policy package installed are fully compromised, allowing attackers to gain unauthorized access to sensitive information such as user and host data. This may lead to exposure of secrets and keys stored on the affected system. The malicious code's stealth techniques increase the difficulty of detection and remediation, potentially allowing persistent unauthorized access.

Remove the express-security-policy package immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted computer. Because the system is considered fully compromised, conduct a thorough investigation and remediation to identify and remove any additional malicious software or backdoors that may have been installed. Follow organizational incident response procedures for compromised hosts.