A malicious package identified in the npm ecosystem is considered fully compromising any computer on which it is installed or running. The presence of this package implies that all secrets and keys stored on the affected system should be rotated immediately from a separate, uncompromised machine. Removal of the package is recommended, but it may not fully eradicate all malicious software introduced by the compromise.