The npm package react-confetti-modern was found to contain malicious code. Installing or running this package can lead to a full compromise of the affected computer. Any secrets or keys stored on the compromised system should be rotated immediately from a different, secure machine. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.