The npm package named 'crowdstrike' version 3.9.0 contains malicious code that installs an info stealer during its installation process. This info stealer targets sensitive tokens related to npm, git, and CI/CD environments. Any system with this package installed or running is considered fully compromised, and all secrets and keys stored on that system should be rotated immediately from a separate, secure machine. Removing the package alone does not guarantee removal of all malicious software introduced.