The npm package path-match-js versions 1.0.7 and 1.0.8 were found to contain malicious code or depend on a malicious package. Any system with these versions installed should be considered fully compromised, requiring immediate secret and key rotation from a separate device. Removing the package alone may not fully eliminate the threat due to potential persistent malicious control.