The package @oec-settlement/react-router version 99.9.1 is identified as malicious due to embedded code that communicates with a domain associated with malicious activity. This behavior indicates potential unauthorized control or data exfiltration risks. The OpenSSF Package Analysis and other sources confirm the malicious nature of this package. There is no CVSS score available, and no official patch or remediation is documented. The threat affects only the exact version 99.9.1 of this package.

Systems with @oec-settlement/react-router version 99.9.1 installed are considered fully compromised. Attackers may have gained control over the system, risking exposure of all stored secrets and keys. The malicious code's communication with a known malicious domain suggests potential data leakage or further compromise. Simply uninstalling the package does not guarantee removal of all malicious components.

Immediate removal of the @oec-settlement/react-router package version 99.9.1 is recommended. All secrets, credentials, and keys stored on affected systems should be rotated from a secure, uncompromised environment. Because the system may be fully compromised, consider rebuilding or restoring from a known good backup. No official patch or fix is available; vigilance and incident response are critical.