The npm package @services-lib/application-http-client contains malicious code that fully compromises any computer on which it is installed or running. The compromise may allow an attacker to gain full control over the affected system. Immediate removal of the package is recommended, but due to the extent of the compromise, simply removing the package may not eliminate all malicious software. All secrets and keys stored on the compromised computer should be rotated from a separate, secure device.