The npm package [email protected] is flagged as malicious. Analysis shows it contains only two files without direct evidence of credential theft, network exfiltration, or installer-time malicious scripts. However, the presence of this package on a system is considered a full compromise, implying that an attacker may have gained control beyond what is visible in the package contents. Consequently, all secrets and keys stored on the affected system should be rotated from a separate, uncompromised machine. Removal of the package is recommended but may not fully remediate the compromise.

Any computer with this package installed or running should be treated as fully compromised. Attackers may have gained control of the system, putting all stored secrets and keys at risk. There is no guarantee that removing the package will remove all malicious components introduced by its installation, potentially allowing persistent unauthorized access.

Remove the malicious package immediately. Rotate all secrets and keys stored on the affected system from a different, clean computer. Because the system is considered fully compromised, assume that additional malicious software may be present and conduct a thorough investigation and remediation beyond just removing the package.