The vectormark package in the npm ecosystem has been identified as containing malicious code that fully compromises affected computers. According to the source advisory, any system with this package installed should be considered fully compromised, with potential unauthorized control granted to external entities. The advisory warns that simply removing the package may not eradicate all malicious components introduced by it. There is no CVSS score available for this threat, and no known exploits in the wild have been reported. No patch or remediation fix is available, as this is a malicious package rather than a vulnerability in legitimate software.

Full compromise of any computer with the vectormark package installed is expected. All secrets and keys stored on the compromised system are at risk and should be considered exposed. The attacker may have persistent access beyond the presence of the package itself, making the system untrustworthy even after package removal.

Remove the vectormark package immediately from all affected systems. Rotate all secrets and keys from a separate, secure computer that has not been compromised. Because the system may remain compromised even after removal, consider rebuilding or fully reimaging affected machines to ensure eradication of malicious software. Monitor for any suspicious activity related to the compromise.