The npm package '@w3m-frame/session_update' version 99.0.4 contains malicious code that executes commands associated with harmful behavior. Any system with this package installed or running should be considered fully compromised. Immediate removal of the package is advised, along with rotation of all secrets and keys from a separate, uncompromised device. However, removal of the package may not fully eliminate all malicious software introduced by its installation.