The svelte-visual-map package version 1.0.0 on npm has been identified as containing malicious code. According to the GHSA malware advisory, any system with this package installed or running should be considered fully compromised. The package does not exhibit typical lifecycle-script droppers or install-time code execution against installer-controlled resources, but the presence of malicious code implies a severe security risk. The advisory strongly recommends immediate rotation of all secrets and keys from a different computer and removal of the package, though removal may not guarantee complete remediation.

Systems with svelte-visual-map version 1.0.0 installed or running are considered fully compromised. Attackers may have gained full control over the affected system, risking exposure of all stored secrets and keys. The compromise may persist even after package removal due to potential additional malicious software installed by the package.

Remove the svelte-visual-map package version 1.0.0 immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Due to the potential persistence of malicious software beyond the package itself, consider a full system investigation and remediation. No official patch or fix is available; the vendor advisory does not provide a remediation update.