The npm package [email protected] has been flagged as malicious by security sources. Static and dynamic analyses found no direct evidence of harmful code execution or data exfiltration mechanisms within the package files. However, a separate authoritative source strongly warns that any system with this package installed should be treated as fully compromised, recommending immediate secret/key rotation and package removal. The package name appears random and may be a placeholder or throwaway, but the risk is severe due to potential full system compromise.

Systems with the [email protected] package installed or running are considered fully compromised. Attackers may have gained full control, risking exposure of all stored secrets and keys. Removing the package alone may not remove all malicious software introduced, necessitating secret/key rotation from a clean system.

Remove the [email protected] package immediately. Rotate all secrets and keys stored on the affected system from a different, uncompromised computer. Due to the potential full system compromise, further forensic analysis and remediation may be required. Patch status is not applicable as this is a malicious package, not a vulnerability with a patch. No official fix or vendor advisory is available.