The npm package @pipi596888/ccursor versions 0.0.16 and 0.0.17 contain malicious code or depend on a malicious package. Installation or execution of this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Removal of the package does not guarantee elimination of all malicious software introduced. Immediate secret and key rotation from a different, uncompromised system is strongly advised.