The @xoxo-momo/kit npm package is identified as containing malicious code that fully compromises the host system upon installation or execution. This compromise potentially grants an attacker full control over the affected computer. Due to the severity of the compromise, all sensitive credentials and keys stored on the system should be considered exposed and must be rotated from a secure environment. Removal of the package does not guarantee eradication of the malicious software or backdoors introduced by the attacker.

Complete system compromise on any computer with the package installed or running. Exposure of all secrets and keys stored on the machine, necessitating immediate credential rotation from a different device. Potential persistence of malicious software beyond package removal.

Immediately remove the @xoxo-momo/kit package from affected systems. Rotate all secrets, keys, and credentials stored on the compromised machine from a separate, secure computer. Conduct a thorough investigation and remediation of the affected system to identify and remove any persistent malicious software or backdoors. Consider rebuilding the system if full eradication cannot be assured.