The npm package karma365-mcp version 2.1.0 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough to consider the entire system fully controlled by an attacker, necessitating immediate rotation of all secrets and keys from a separate, uncompromised device. Removing the package alone does not guarantee removal of all malicious components.