The winjb6 npm package contains malicious code that compromises any computer on which it is installed or running. Full system compromise is indicated, with a recommendation to rotate all secrets and keys from a separate, uncompromised machine. Removal of the package alone may not eliminate all malicious components due to potential persistent control by an attacker.