The 'lwp-web-client' package in the npm ecosystem has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the affected computer. Due to the severity of the compromise, all sensitive credentials and keys stored on the system must be rotated from a different, uncompromised device. Simply uninstalling the package is insufficient to ensure system security, as the attacker may have installed persistent backdoors or other malicious components.

Full system compromise on any computer with the package installed or running. Potential exposure and theft of all stored secrets and keys. Persistent malicious presence may remain even after package removal, leading to ongoing risk.

Remove the 'lwp-web-client' package immediately. Rotate all secrets and keys stored on the affected system from a separate, trusted computer. Conduct a thorough investigation and remediation of the affected system, as removal of the package alone does not guarantee elimination of all malicious software. No official patch or fix is available; remediation relies on removal and credential rotation.