The npm package @nolimit-agent/win32-x64 versions 1.0.120 through 1.0.135 contain malicious code or depend on malicious code. Installation or execution of this package can lead to full compromise of the affected system. Secrets and keys stored on the compromised system should be rotated immediately from a different device. Removing the package alone may not fully remediate the infection due to potential persistent malicious software.