The npm package 'statist-browser-typed-client-eventea.projects.pwahelp' version 35.8.0 is identified as malicious. Although it does not contain code paths that read installer secrets, fetch and execute remote content, or establish persistence, its installation compromises the host system. Any computer with this package installed should be considered fully compromised, and all stored secrets and keys must be rotated immediately. Removal of the package alone may not eliminate all malicious software introduced by it.