The 'kartyk-github-token-pkg' npm package versions 1.0.3 and 1.0.4 have been identified as containing malicious code. Installation or execution of this package results in a full system compromise, granting attackers potential control over the affected machine. Due to the severity of the compromise, simply removing the package may not eliminate all malicious artifacts or backdoors introduced. The advisory recommends rotating all secrets and keys stored on the compromised system from a separate, secure environment.

Any computer with this package installed or running should be considered fully compromised. Attackers may have gained full control, risking exposure or theft of all secrets and keys stored on the system. The compromise may persist even after package removal, indicating potential persistence mechanisms or additional malware installed.

Remove the 'kartyk-github-token-pkg' package immediately from affected systems. Rotate all secrets and keys stored on the compromised computer from a different, uncompromised machine. Due to the possibility of persistent compromise, consider a full system rebuild or forensic analysis to ensure all malicious components are eradicated.