The npm package 'rc-icon' contains malicious code that can fully compromise any computer on which it is installed or running. This compromise may allow an attacker to gain full control over the affected system. Due to the severity of the compromise, all secrets and keys stored on the computer should be rotated immediately from a different, trusted machine. Simply removing the package does not guarantee removal of all malicious software introduced by it.