The @peptide-unit/js-unimode npm package is identified as malicious software that, once installed, grants an attacker full control over the affected computer. This level of compromise implies that sensitive information such as secrets and keys stored on the machine are at risk and must be rotated from a secure environment. The malicious code may install additional backdoors or malware, making simple removal of the package insufficient to fully remediate the infection.

Complete system compromise on any computer with the package installed or running. Potential exposure and theft of stored secrets and keys. Persistent malicious presence may remain even after package removal, risking ongoing unauthorized access and data exfiltration.

Remove the @peptide-unit/js-unimode package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised machines, performing this rotation from a separate, trusted device. Conduct a thorough investigation and remediation of the affected systems to detect and remove any additional malware or backdoors that may have been installed. Because full control may have been given to an attacker, consider rebuilding or isolating affected systems to ensure complete eradication.