The 'lzd-unified-station-sdk' npm package is identified as malicious software that, when installed or executed, can lead to a complete system compromise. This includes potential unauthorized access and control by an external entity. The advisory strongly recommends immediate secret and key rotation from a separate secure environment and removal of the package, while noting that removal may not fully eradicate the threat due to possible persistent backdoors or additional malware installed by the attacker.

Full system compromise on any computer with the package installed or running. All stored secrets and keys on the compromised system are at risk and must be rotated. The attacker may maintain persistent access even after package removal, indicating a high risk of ongoing unauthorized control and data exposure.

Immediately remove the 'lzd-unified-station-sdk' package from all affected systems. Rotate all secrets, keys, and credentials from a separate, secure machine. Conduct a thorough investigation and system cleanup to detect and remove any additional malware or backdoors that may have been installed. Consider rebuilding the affected systems if full trust cannot be restored. No official patch or fix is available; mitigation relies on removal and secret rotation.