The npm package [email protected] is flagged as malicious by security sources including Amazon Inspector and GHSA malware advisories. The package itself contains only two files with no direct install-time malicious scripts or obvious payloads, but its suspicious naming and minimal footprint indicate it is likely a placeholder or test package used for malicious purposes. The advisory strongly warns that any computer with this package installed should be treated as fully compromised, requiring immediate rotation of all secrets and keys from a separate, trusted machine. Removing the package does not guarantee removal of all malware that may have been installed as a result.

Systems with [email protected] installed are considered fully compromised. Attackers may have gained full control, potentially exposing all stored secrets and keys. The presence of this package indicates a severe security breach, and sensitive credentials should be rotated immediately. Removal of the package alone is insufficient to ensure system integrity.

Remove the [email protected] package immediately. Rotate all secrets and keys stored on the affected system from a different, secure computer. Conduct a thorough investigation and remediation of the affected system as full compromise is likely. There is no known patch or official fix for this malicious package; prevention relies on avoiding installation and prompt removal if detected.