The @lodash-en/lodash-en package distributed via npm has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker complete control. Due to the severity of the compromise, all sensitive credentials on the affected system must be rotated from a different, secure environment. Simply uninstalling the package does not ensure removal of all malicious artifacts or backdoors introduced by the package.

Full system compromise on any computer with the package installed or running. This includes potential unauthorized access to all stored secrets and keys, requiring immediate credential rotation. The persistence of malicious software beyond package removal indicates a high risk of ongoing unauthorized control.

Remove the @lodash-en/lodash-en package immediately. Rotate all secrets and keys stored on the affected system from a separate, uncompromised computer. Because the system may be fully compromised, consider rebuilding the system from a known good backup or reinstalling the operating system to ensure complete removal of malicious software.