The 'source-analyzer' npm package in versions 0.5.7, 0.5.8, and 0.5.9 was found to include malicious code or to depend on a malicious package. According to the source details, any system with this package installed or running should be considered fully compromised. The malicious code may grant an attacker full control over the affected system. Due to the severity of the compromise, simply removing the package may not eliminate all malicious artifacts. Secrets and keys stored on the compromised system must be rotated from a different, secure system to prevent further unauthorized access.

Systems with the affected versions of 'source-analyzer' installed or running are at risk of full compromise, including unauthorized access to stored secrets and keys. The attacker may gain persistent control over the system, making it unsafe to trust the integrity of the compromised environment even after package removal.

Remove the affected versions (0.5.7, 0.5.8, 0.5.9) of the 'source-analyzer' package immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure computer. Due to the potential for persistent compromise, consider rebuilding or fully cleaning the affected system to ensure removal of all malicious components.