The @jacobtan/decode-sdk package on npm has been identified as containing malicious code that grants full control over the infected system to an attacker. This level of compromise means that any sensitive information, including secrets and keys stored on the system, is at risk. The advisory explicitly states that the system should be considered fully compromised and that remediation requires rotating all credentials from a separate, uncompromised machine. There is no indication of a patch or fix for the package itself, and removal of the package does not ensure complete eradication of the malicious presence.

Complete system compromise on any computer with the package installed or running. Potential exposure and theft of all stored secrets and keys. The attacker may have persistent access beyond the presence of the package itself.

Immediately remove the @jacobtan/decode-sdk package from all affected systems. Rotate all secrets, keys, and credentials from a separate, trusted computer to prevent further unauthorized access. Because the system is considered fully compromised, a full forensic investigation and system rebuild may be necessary to ensure complete removal of malicious components. No official patch or fix is available for the package itself.