The @akshajrawat/plugin-repo-cli npm package is identified as containing malicious code that compromises the host system completely. According to the source details, installation or execution of this package results in full system compromise, including exposure of stored secrets and keys. The attacker may have persistent access beyond the presence of the package itself, making remediation challenging. No patch or fix is available, and the package should be removed immediately. Secrets and keys must be rotated from a secure, uncompromised environment.

Full compromise of any computer with the package installed or running. All stored secrets and keys on the affected system are considered exposed and must be rotated. The attacker may maintain persistent control even after package removal, increasing the risk of ongoing unauthorized access.

Remove the @akshajrawat/plugin-repo-cli package immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Because full control may have been given to an attacker, consider the system fully compromised and perform a thorough investigation and remediation, including potential system rebuilds. No official patch or fix is available.