The npm package @mrlegendbot/libsignal-node contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough to consider the system fully controlled by an attacker, necessitating immediate rotation of all secrets and keys from a different, trusted machine. Simply removing the package does not guarantee removal of all malicious components.