The npm-doc-dev package versions 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0, and 1.1.1 contain malicious code that fully compromises the host computer. Installation or execution of this package can lead to complete system compromise, including potential unauthorized access to secrets and keys stored on the device. Due to the severity of the compromise, simply uninstalling the package may not remove all malicious components or backdoors introduced by the attacker.

Any system with the affected versions of npm-doc-dev installed or running should be considered fully compromised. Attackers may have gained full control over the system, risking exposure or theft of sensitive data such as secrets and cryptographic keys. The integrity and confidentiality of the affected system cannot be assured without thorough remediation.

Remove the malicious npm-doc-dev package immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted computer. Because full system compromise is likely, consider rebuilding the affected system from a known good backup or reinstalling the operating system to ensure complete removal of malicious software. No official patch or fix is indicated; remediation relies on removal and secret rotation.