The npm package [email protected] contains two files and does not exhibit typical supply-chain attack patterns such as install-time code execution, credential access, or backdoors according to static and traced analysis. However, the package is flagged as malicious by GHSA-malware sources, indicating that any system with this package installed should be considered fully compromised. The package name appears unrelated to known projects and may be a placeholder or test publication. Despite the lack of direct evidence of malicious code execution, the risk is deemed severe enough to warrant full secret/key rotation and removal of the package.

Any computer with [email protected] installed or running is considered fully compromised, implying potential unauthorized control or data exposure. All secrets and keys stored on the affected system should be rotated immediately from a different, secure machine. Removing the package alone may not fully remediate the compromise due to possible persistence or additional malicious software installed.

Remove the [email protected] package immediately. Rotate all secrets and keys from a separate, uncompromised system. Because the system may be fully compromised, consider a full system rebuild or forensic analysis to ensure complete remediation. No official patch or fix is available; remediation relies on removal and secret rotation.