The flight-compare-analyzer package in the npm ecosystem is identified as containing malicious code that results in full compromise of any system where it is installed or executed. The compromise is severe enough that all stored secrets and keys on the affected system should be considered exposed and must be rotated from a different, secure machine. The malicious package may install additional malware or backdoors, so simply uninstalling the package does not ensure complete remediation.

Full system compromise on any computer with the package installed or running. Exposure of all secrets and keys stored on the compromised system. Potential persistence of malicious software beyond the presence of the package itself.

Remove the flight-compare-analyzer package immediately. Rotate all secrets and keys stored on the affected system from a separate, uncompromised computer. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected machine to ensure removal of all malicious components. No official patch or fix is available as this is a malicious package rather than a vulnerability in legitimate software.