The npm package 'string-morph' has been identified as containing malicious code that results in a full system compromise upon installation or execution. According to the source advisory, any system with this package installed should be considered fully compromised, with potential unauthorized control by an external entity. The advisory warns that simply removing the package may not remove all malicious artifacts. There is no CVSS score available for this threat. No known exploits in the wild have been reported yet. No patch or remediation fix is provided, and the package should be removed immediately.

Full compromise of any system with the string-morph package installed or running. Potential unauthorized control by attackers, risking exposure of all secrets and keys stored on the system. The threat is severe enough to require immediate secret/key rotation and system remediation.

Remove the string-morph package immediately from all affected systems. Rotate all secrets and keys stored on the compromised machine from a separate, secure system. Because the system may be fully compromised, further forensic analysis and remediation may be necessary. No official patch or fix is available; the package itself is malicious.