The @cw-ui/asio-neon-themes package distributed via npm has been identified as containing malicious code. According to the source advisory, any system with this package installed should be considered fully compromised. The malicious code potentially grants an external attacker full control over the affected computer. Because of this, all sensitive credentials stored on the system must be rotated immediately from a different, uncompromised machine. Simply uninstalling the package does not ensure removal of all malicious artifacts or backdoors introduced by the package.

Full system compromise on any computer with the package installed. Exposure and potential theft of all secrets and keys stored on the system. Persistent malicious presence may remain even after package removal, risking ongoing unauthorized access.

Remove the @cw-ui/asio-neon-themes package immediately. Rotate all secrets and keys stored on the affected system from a separate, secure computer. Because full compromise is likely, consider rebuilding the affected system from a known good state to ensure complete removal of malicious software.