The npm package 'wsh4-nmp' version 1.0.0 has been identified as malicious. It communicates with domains associated with malicious activity, indicating it may compromise any system where it is installed. Systems with this package should be considered fully compromised, and all secrets and keys stored on those systems should be rotated immediately from a different, trusted computer. Removing the package alone may not fully eliminate the threat due to potential persistent malicious software.