The typescript-util-core package distributed via npm has been identified as containing malicious code. Installation or execution of this package results in a complete compromise of the affected system, potentially allowing an attacker full control. Due to the severity of the compromise, all credentials and secrets stored on the system should be considered exposed and must be rotated from a secure environment. The package removal is necessary but insufficient to fully remediate the compromise.

Any system with this package installed or running is fully compromised, exposing all stored secrets and keys. Attackers may have persistent access and control, making the system untrustworthy. The compromise extends beyond the package itself, as additional malicious software may have been installed.

Immediately remove the typescript-util-core package from affected systems. Rotate all secrets and keys from a separate, secure computer to prevent further unauthorized access. Because the system is fully compromised, consider rebuilding or restoring from a known good backup to ensure complete remediation.