The 'kijai' package in the npm ecosystem is identified as malicious software. According to the source advisory, any system with this package installed should be considered fully compromised. This implies that attackers may have gained full control over the affected system. The advisory recommends removing the package and rotating all secrets and keys from a separate, secure machine. No patch or fix is available, and the malicious package itself is the root cause of the compromise.

Full system compromise on any computer with the 'kijai' package installed or running. All secrets and keys stored on the affected system are at risk and should be considered compromised. Removal of the package alone does not guarantee removal of all malicious artifacts, indicating persistent or additional malware may be present.

Remove the 'kijai' package immediately from affected systems. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Because the system is fully compromised, consider rebuilding or thoroughly cleaning the affected machine to ensure removal of all malicious software. No official patch or fix is available for this malicious package.