The npm package 'resource-lease-pool' version 1.4.2 contains malicious code or depends on a package with malicious code. Installing or running this package can lead to a full compromise of the affected system. Secrets and keys stored on the compromised system should be rotated immediately from a different, secure machine. Removing the package alone may not fully eliminate the malicious presence due to potential persistent control by an attacker.