The npm package signals-embed was found to contain malicious code. Any system with this package installed or running should be considered fully compromised. It is recommended to remove the package and immediately rotate all secrets and keys from a different, trusted computer. However, removal of the package does not guarantee elimination of all malicious software that may have been installed as a result.