The npm package 'kanyut' version 1.0.0 is identified as malicious. While static analysis found no direct evidence of secret exfiltration or install-time malicious hooks, a malware advisory states that any system with this package installed should be considered fully compromised. Immediate removal and secret/key rotation are recommended due to the risk of full system compromise.