The npm package @settle-sea/supporting-documents version 99.9.1 contains malicious code that communicates with a domain linked to malicious activity. Installing or running this package can lead to a full compromise of the affected system. Secrets and keys stored on compromised systems should be rotated immediately from a secure environment. Removing the package alone may not fully remediate the compromise due to potential persistent malicious software.