The npm package @sumoinc/trashpanda contains malicious code that fully compromises any computer where it is installed or running. The presence of this package implies that all secrets and keys stored on the affected system should be considered compromised and rotated immediately from a different, secure machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have established persistent control over the system.