The npm package 'downlynpm' versions 1.0.0, 1.0.1, and 1.0.2 contains malicious code or depends on a package with malicious code. Installing or running this package can lead to full compromise of the affected system. Secrets and keys stored on the compromised system should be rotated immediately from a different, secure machine. Removing the package alone may not fully remove the malicious software or undo the compromise.