The 'lwc-slds-lbc' package in the npm ecosystem is identified as malicious software. According to the source advisory, any system with this package installed should be considered fully compromised. Attackers may have gained full control, potentially accessing and exfiltrating sensitive information such as secrets and keys. The advisory strongly recommends immediate rotation of all secrets and keys from a separate, uncompromised system. Due to the possibility of persistent backdoors or additional malware, simply uninstalling the package does not ensure complete remediation.

Full system compromise on any computer with the package installed. Exposure and potential theft of stored secrets and keys. Persistent attacker control may remain even after package removal, risking ongoing unauthorized access and data exfiltration.

Remove the 'lwc-slds-lbc' package immediately from all affected systems. Rotate all secrets, keys, and credentials from a different, trusted computer to prevent misuse. Conduct a thorough security assessment and remediation of the affected systems, as removal of the package alone may not eliminate all malicious components. Monitor for signs of persistent compromise and consider rebuilding affected systems if necessary.