The npm package @zahlen/checkout version 0.2.2 has been flagged as malicious by the GHSA-malware source. Although static analysis and code path tracing did not reveal typical malicious behaviors like remote content execution or credential exfiltration, the package is considered fully compromising to any system where it is installed or running. This implies that the package likely contains hidden or obfuscated malicious code that grants an attacker full control over the system. The advisory recommends immediate removal and secret rotation to mitigate impact.

Any computer with @zahlen/checkout version 0.2.2 installed or running should be considered fully compromised. Attackers may have gained full control, putting all stored secrets and keys at risk. Removing the package alone may not eliminate all malicious components introduced by the package, so secret rotation and further remediation are necessary.

Remove the @zahlen/checkout package version 0.2.2 immediately from all affected systems. Rotate all secrets and keys stored on the compromised computer from a separate, trusted machine. Since full control may have been given to an attacker, further forensic analysis and remediation may be required. No official patch or fix is available; the package should be considered unsafe and avoided.