The 'pump-laserstream-parser' package in the npm ecosystem contains malicious code or relies on a dependency that does. Installation or execution of this package results in a full system compromise, potentially exposing all stored secrets and keys. The advisory strongly recommends treating any system with this package as compromised and taking immediate remediation steps including secret rotation and package removal. No CVSS score is provided, but the impact is critical due to full compromise.

Systems with the 'pump-laserstream-parser' package installed or running are considered fully compromised. Attackers may have gained complete control, risking exposure of all stored secrets and keys. Removing the package alone may not remove all malicious artifacts, indicating persistent compromise.

Remove the 'pump-laserstream-parser' package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a different, secure computer. Because full system compromise is likely, further forensic analysis and remediation may be necessary. No official patch or fix is available; the package should be considered malicious and avoided.