The 'lines-columns' package on npm is a malicious package designed to impersonate the popular 'lines-and-columns' library. While it reimplements the legitimate functionality, it also contains suspicious unused exports with random strings. According to the GHSA malware advisory, any system with this package installed or running should be considered fully compromised. Attackers may have gained full control, and all secrets and keys stored on the system must be rotated from a different, clean machine. The package itself does not include install scripts, network I/O, or direct system access code, but the compromise risk is severe and complete.

Systems with the 'lines-columns' package installed or running are considered fully compromised. Attackers may have gained full control over the affected computer, risking exposure of all stored secrets and keys. Immediate rotation of all credentials is required. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

Remove the 'lines-columns' package immediately. Rotate all secrets and keys stored on the affected computer from a separate, uncompromised machine. Because the system is considered fully compromised, further forensic analysis and remediation may be necessary. No official patch or fix is available; the package itself is malicious and should be avoided.