The tailwind-scroller package version 1.0.2 on npm is identified as containing malicious code that results in a full system compromise. According to the source advisory, any system with this package installed or running should be considered fully compromised, necessitating immediate secret and key rotation from a separate device. Removal of the package alone is insufficient to ensure complete remediation due to potential persistence of malicious components.

Full compromise of affected systems, including potential unauthorized access and control. All stored secrets and keys on the compromised system are at risk and must be rotated. The malicious code may have established persistent backdoors or other malware that remain even after package removal.

Remove the tailwind-scroller package version 1.0.2 immediately from all affected systems. Rotate all secrets and keys stored on those systems using a separate, uncompromised device. Because full control may have been given to an attacker, consider rebuilding or thoroughly cleaning affected systems to ensure complete removal of malicious software. No official patch or fix is available; remediation relies on removal and secret rotation.