The artifactregistry-login npm package version 9.9.0 contains malicious code that installs an info stealer during installation. This malware targets and steals npm, git, and other CI/CD related tokens, potentially compromising the entire system. Any computer with this package installed should be considered fully compromised, and all secrets and keys stored on that computer must be rotated immediately from a different machine. Removing the package alone does not guarantee removal of all malicious software.