The 'sort-btree' npm package versions 2.1.6 and 2.2.0 have been identified as malicious. Static analysis found patterns in minified JavaScript files that include references to child process spawning and HTTP-related tokens, which may indicate malicious behavior. However, no direct evidence of runtime execution of these capabilities, network communication, or command and control infrastructure was confirmed. The package masquerades as a B+ tree data structure library but is flagged as a malicious package that compromises the host system. Due to the potential for full system compromise, any system with this package installed should be treated as compromised.

Any computer with the affected versions of 'sort-btree' installed or running is considered fully compromised. This implies that attackers may have gained full control over the system, potentially exposing all stored secrets and keys. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.

Remove the 'sort-btree' package versions 2.1.6 and 2.2.0 immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, trusted system. Because full system compromise is possible, further forensic analysis and remediation may be necessary. No official patch or fix is currently available; therefore, avoidance of these versions is critical.