The npm package svelte-mapped-metrics version 1.0.0 is identified as malicious. Although no direct evidence of credential theft or remote code execution was found during installation or import, the package is considered fully compromising any system on which it is installed. Immediate removal of the package and rotation of all secrets and keys stored on the affected system are strongly recommended. Due to potential full system compromise, removing the package alone may not eliminate all malicious components.