The npm package @oec-settlement/react-router version 99.9.1 contains malicious code that communicates with a domain linked to malicious activity. Any system with this package installed or running should be considered fully compromised. Secrets and keys on affected systems must be rotated immediately from a different, trusted machine. Removing the package alone may not eliminate all malicious software introduced by it.