The npm package react-router-dom.js version 1.0.0 is identified as a malicious multi-stage information stealer. Upon installation, it executes a payload that opens a new terminal and compromises the host system. Any computer with this package installed should be considered fully compromised, and all stored secrets and keys must be rotated from a secure machine. Removing the package alone may not eliminate all malicious software introduced.