The npm package 'metrica-node' version 2.4.5 contains malicious code that fully compromises any computer on which it is installed or running. The compromise allows an outside entity potential full control over the affected system. Immediate removal of the package is recommended, but this may not eliminate all malicious software introduced. All secrets and keys stored on the compromised machine should be rotated from a separate, secure device.