The npm package array-inline version 2.0.5 is identified as malicious. Although static analysis and behavior tracing did not detect typical malicious activities such as credential access or network exfiltration, the package is considered fully compromising to any system where it is installed or running. Immediate secret and key rotation from a different machine is advised, and the package should be removed. However, removal may not fully eliminate the compromise as the attacker may have established persistent control.