The npm package svelte-map-visual version 1.0.0 has conflicting reports regarding malicious behavior. Amazon Inspector found no evidence of malicious code such as lifecycle scripts fetching remote content, credential scraping, or backdoors. Conversely, the GHSA malware advisory states that any computer with this package installed should be considered fully compromised, recommending immediate secret rotation and removal of the package. No official patch or remediation is documented, and no active exploits are known in the wild.

If the GHSA malware assessment is accurate, installation of svelte-map-visual version 1.0.0 could lead to full system compromise, including potential exposure of all secrets and keys stored on the affected machine. This would require immediate secret rotation and system remediation. However, the conflicting report from Amazon Inspector indicates no malicious behavior was detected in the package files themselves, creating uncertainty about the actual impact.

Due to conflicting reports, the safest approach is to remove the svelte-map-visual package version 1.0.0 from any affected systems. Immediately rotate all secrets and keys that may have been exposed. There is no official patch or fix available; monitor vendor advisories for updates. Since no lifecycle scripts or remote fetching were detected by one source, but full compromise is warned by another, assume compromise until proven otherwise.