The firefly-shared-js npm package is identified as malicious software involved in a campaign targeting developers since 2021. It steals source code and secrets from infected systems. Any computer with this package installed or running is considered fully compromised, and all stored secrets and keys should be rotated immediately from a different, secure machine. Removing the package alone may not eliminate all malicious software due to potential full system compromise.