The npm package statist-browser-typed-client-eventea.projects.tdevice version 0.0.1 is identified as malicious. Although the package contains only two files and does not exhibit typical installer-time malicious behaviors such as credential access, network exfiltration, or backdoors, its presence on a system indicates a full compromise. Systems with this package installed should be considered fully compromised, and all secrets and keys on the system should be rotated from a different, clean computer. Removing the package alone may not eliminate all malicious software resulting from its installation.