The 'rnx-align-deps' npm package has been identified as containing malicious code. According to the source data, any system with this package installed should be considered fully compromised. The malicious package may grant attackers full control over the system, necessitating secret and key rotation from a separate machine. Although removal of the package is advised, it may not fully eradicate all malicious components introduced during installation. No static or behavioral findings suggest credential access or network exfiltration patterns, but the overall compromise risk remains critical.

Systems with the 'rnx-align-deps' package installed or running are considered fully compromised. Attackers may have gained full control, risking exposure of all stored secrets and keys. The compromise is severe enough to require immediate secret rotation and package removal, but residual malicious software may persist even after removal.

Remove the 'rnx-align-deps' package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, trusted computer. Due to the potential persistence of malicious software beyond the package itself, consider full system remediation or reimaging to ensure complete removal of the threat.