The npm package poly-provider-api version 4.6.1 is identified as malicious. Installation or execution of this package can lead to full compromise of the affected system. Users should consider all secrets and keys on the compromised system as exposed and rotate them immediately from a separate, secure device. Removal of the package alone may not fully eliminate the malicious presence due to potential persistent backdoors or additional malware installed.