The npm package '@pyme-web/web-api' version 99.0.4 contains malicious code that executes commands associated with harmful behavior. Installation or execution of this package can lead to full compromise of the affected system. Immediate removal of the package and rotation of all secrets and keys stored on the compromised machine are strongly advised. However, due to the potential for persistent malicious software beyond the package itself, complete remediation may require additional measures.