The npm package 'hrp987' contains malicious code that communicates with a domain linked to malicious activity. Installation or execution of this package can lead to a full compromise of the affected computer. Secrets and keys stored on the compromised system should be rotated immediately from a different, secure machine. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.