The npm package overarch-windows-x64-yr in versions 1.4.0, 1.5.0, and 2.0.0 is identified as malicious software. Although no direct malicious behaviors such as reading secrets, executing remote code, or opening backdoors were detected during installation or import, the package is considered fully compromising any computer on which it is installed or running. Immediate removal of the package and rotation of all secrets and keys from a different computer are strongly advised.