The @yggbrasil/api package distributed via npm has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker to gain complete control. The compromise includes the risk of exposure of sensitive information such as secrets and keys stored on the machine. Due to the severity of the compromise, simply removing the package may not be sufficient to fully eradicate the malicious presence.

Any system with the @yggbrasil/api package installed or running should be considered fully compromised. Attackers may have gained full control over the system, including access to all stored secrets and keys. This represents a critical security breach with potential for extensive data loss and further system exploitation.

Remove the @yggbrasil/api package immediately from all affected systems. Rotate all secrets and keys that were stored on the compromised machines, using a separate, trusted system. Due to the possibility of persistent malicious software beyond the package itself, consider full system reimaging or restoration from a known good backup to ensure complete remediation.