The npm package @aspect-security/argon2 contains malicious code that performs data exfiltration and arbitrary command execution via its preinstall script. Installing or running this package can lead to full system compromise. Removal of the package does not guarantee elimination of all malicious artifacts, and any secrets or keys on the affected system should be rotated immediately from a separate, uncompromised device.