The @gleamkit/probe npm package at version 0.0.1 is classified as malicious by the GHSA malware advisory MAL-2026-6306. Despite no detected suspicious behaviors by Amazon Inspector, the package is considered a supply-chain threat that can fully compromise a host system. The advisory warns that installation may grant an external attacker full control, necessitating secret rotation and system remediation beyond simple package removal. No CVSS score or exploit in the wild is reported.

Any computer with @gleamkit/probe version 0.0.1 installed should be considered fully compromised. Attackers may have gained full control, risking exposure of all stored secrets and keys. Removal of the package alone may not eradicate all malicious components introduced by the package.

Remove the @gleamkit/probe package version 0.0.1 immediately. Rotate all secrets and keys stored on the affected system from a separate, trusted machine. Conduct a thorough system investigation and remediation, as removing the package may not fully eliminate the compromise. No official patch or fix is available; the package itself should be considered malicious and avoided.