The npm package 'dom-weave' contains malicious code that fully compromises any computer on which it is installed or running. The compromise potentially allows an attacker full control over the affected system. Immediate rotation of all secrets and keys stored on the compromised machine is recommended. Simply removing the package may not eliminate all malicious software introduced by the installation, as the attacker may have established persistent control.