The winston-prism npm package version 1.0.1 has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker to gain complete control. The malicious nature of the package means that sensitive information such as secrets and keys stored on the compromised machine may be exposed. Because the attacker may have established persistent access, simply uninstalling the package may not remove all malicious components.

Systems with winston-prism version 1.0.1 installed are fully compromised, risking exposure of all stored secrets and keys. Attackers may have full control over the affected system, leading to potential data theft, unauthorized access, and further malicious activity. The compromise is severe and complete remediation requires key rotation and thorough system cleaning beyond package removal.

Remove the winston-prism package version 1.0.1 immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure device. Conduct a comprehensive investigation and cleaning of the affected system to detect and remove any persistent malicious software. No official patch or fix is available; remediation relies on removal and system recovery procedures.