Share on :
A malicious package is a package which compromises your code or your server once it's run, the risk of that can vary from stealing your info,users' info, keystrokes to fully compromising your server or device
The package should be removed, but as you may be fully compromised, that might not be enough, your device should be investigated carefully.