The npm package 'legacy_esg_odf_common' version 1.0.1 is identified as malicious. It communicates with a domain linked to malicious activity and executes commands associated with harmful behavior. Any system with this package installed should be considered fully compromised, and all stored secrets and keys must be rotated immediately from a different machine. Removal of the package alone may not eliminate all malicious components due to potential full system compromise.