The npm package @seggy116/next-diff version 0.3.0 is identified as malicious. Although some analysis suggests the bundled UI code contains typical 'ping' tokens without direct evidence of exfiltration or credential theft, another source strongly indicates that any system with this package installed should be considered fully compromised. Immediate secret and key rotation is advised, and removal of the package is recommended, though complete remediation may require further system cleansing due to potential full control by an attacker.