The npm package '@m0ntana/app.web' versions 99.0.2, 99.0.3, 99.0.5, and 99.0.6 contain malicious code that executes commands associated with malicious behavior. Any system with this package installed should be considered fully compromised, and all secrets and keys stored on that system must be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.