The npm package 'semaphore-job-pool' version 2.2.2 was found to contain malicious code or depend on a package with malicious code. Any system with this package installed or running should be considered fully compromised. Immediate removal of the package and rotation of all secrets and keys from a different, trusted system is strongly advised. However, removal of the package alone may not eliminate all malicious software introduced by it.