The 'parket-flow' npm package version 3.0.1 imports the Node.js child_process module and invokes execSync with bash and zsh shells. Although it is unclear if these shell invocations are legitimate or attacker-controlled, the package is flagged as malicious by GHSA-malware sources. The presence of this package on a system implies full compromise, with potential unauthorized code execution and control. No direct evidence of exfiltration or network beaconing was found in the inspected code, but the risk remains high due to the nature of the shell command execution. Immediate human review of the shell command construction is advised if the package is encountered.

Any computer with 'parket-flow' version 3.0.1 installed or running should be considered fully compromised. Attackers may have gained full control over the system, putting all stored secrets and keys at risk. The compromise may extend beyond the package itself, potentially involving additional malicious software. This represents a critical security risk to affected systems.

Remove the 'parket-flow' package version 3.0.1 immediately from all affected systems. Rotate all secrets and keys stored on compromised systems from a separate, trusted environment. Conduct a thorough investigation and remediation of the affected systems to identify and remove any additional malicious software or persistence mechanisms. Due to the severity of the compromise, consider rebuilding affected systems if full remediation cannot be assured.