The 'kirkland' package on npm is identified as malicious software that, when installed or executed, results in a full compromise of the host computer. The compromise extends to all stored secrets and keys, which must be rotated immediately from a different machine. Due to the depth of control potentially gained by an attacker, simply uninstalling the package does not ensure removal of all malicious components.

Full system compromise on any computer with the 'kirkland' package installed or running. All secrets and keys stored on the system are at risk and should be considered compromised. The attacker may maintain persistent access beyond the presence of the package itself.

Remove the 'kirkland' package immediately. Rotate all secrets and keys from a separate, uncompromised computer. Because full control of the system may have been granted to an attacker, consider the system fully compromised and perform a thorough incident response, including system reimaging if necessary.