The 'fetch-runtime' package on npm is a malicious clone of the 'make-fetch-happen' library. It exports two constants containing opaque base64-encoded strings that are never decoded or executed within the package, indicating a potential two-stage attack vector where another component might use these exports as payload or keys. The package does not execute network I/O or lifecycle scripts by itself, so installing or requiring it alone does not directly cause exfiltration or remote code execution. However, the presence of this package on a system is considered a strong indicator of full system compromise, as per the GHSA advisory, and all secrets on the affected system should be rotated from a clean environment.

Any system with the 'fetch-runtime' package installed should be considered fully compromised. Attackers may have gained complete control, and all stored secrets and keys on that system are at risk. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors, implying a high risk of persistent compromise.

Remove the 'fetch-runtime' package immediately. Rotate all secrets and credentials from a different, uncompromised system. Due to the likelihood of full system compromise, consider rebuilding the affected system from a known clean state. There is no official patch or fix available for this malicious package; remediation relies on removal and secret rotation.