The npm package truecxikdsal version 1.0.0 is identified as malicious. Although static and dynamic analysis did not reveal typical supply-chain attack behaviors such as exfiltration or backdoors, the package is considered fully compromising to any system where it is installed or running. Immediate removal and secret/key rotation from a separate, uncompromised system are strongly advised. There is no guarantee that removing the package will eliminate all malicious components due to potential full system compromise.