The npm package eslint-plugin-totara version 99.9.1 contains malicious code that communicates with a domain linked to malicious activity. Installation or execution of this package may lead to full compromise of the affected system. Removal of the package alone may not eliminate all malicious components, and any secrets or keys stored on the compromised system should be rotated immediately from a different, clean device.