The react-emits package in the npm ecosystem has been identified as containing malicious code. According to the source details, any system with this package installed should be considered fully compromised. This implies that attackers may have gained full control over the system, potentially accessing sensitive information such as secrets and keys. The advisory warns that simply removing the package may not fully remediate the compromise, as additional malicious software may have been installed. No CVSS score or detailed technical vulnerability information is provided.

Full system compromise on any computer with the react-emits package installed or running. Potential exposure and theft of all secrets and keys stored on the affected system. Persistent malicious presence may remain even after package removal.

Remove the react-emits package immediately from all affected systems. Rotate all secrets and keys from a different, uncompromised computer to prevent unauthorized access. Conduct a thorough security assessment of the affected systems to identify and remove any additional malicious software. Because full control may have been given to attackers, consider rebuilding affected systems from trusted backups or clean installations.