The npm package 'goji-js-org' versions 2.0.0 and 99.0.0 are identified as malicious. It installs a dependency from a custom domain that executes an information stealer during installation, targeting npm, git, and CI/CD tokens. Systems with this package installed should be considered fully compromised, and all secrets and keys must be rotated from a different machine. Removal of the package alone may not eliminate all malicious software due to potential full system compromise.