The 'routecraft' npm package versions 4.2.0 and 5.0.0 masquerades as a lightweight HTTP routing framework but actually ships verbatim Express.js source code without attribution. It includes a 'preinstall' script that conditionally loads the 'procwire' dependency on Windows platforms running Node.js 18 or later. This indirect loading of an unpinned transitive dependency is a known technique to hide malicious payloads. The package's installation can lead to full system compromise, as indicated by the vendor advisory stating that any system with this package installed should be considered fully compromised.

Installation of the affected 'routecraft' package versions can result in full system compromise on Windows systems with Node.js 18 or higher. Attackers may gain full control over the compromised system, potentially exposing all stored secrets and keys. The malicious payload is executed during package installation, and simply removing the package does not guarantee removal of all malicious artifacts.

Immediate removal of the 'routecraft' package versions 4.2.0 and 5.0.0 is recommended. All secrets, keys, and credentials stored on the compromised system should be rotated from a separate, trusted system. Due to the potential full compromise, a full system investigation and remediation may be necessary. No official patch or fix is available; the package itself is malicious and should be avoided entirely.