The npm package 'rbac-auth' versions 1.0.6 and 1.1.6 contains malicious code or depends on a package with malicious code. Systems with this package installed should be considered fully compromised, and all stored secrets and keys must be rotated immediately from a different machine. Removing the package alone may not eliminate all malicious software due to potential full system compromise.