The @meego-progressive/cdk package distributed via npm is identified as malicious. Installation or execution of this package results in full compromise of the host system. The malicious code potentially grants an attacker complete control over the affected computer. Due to the severity of the compromise, secrets and keys stored on the machine must be rotated from a different, uncompromised system. Removal of the package is recommended but may not fully remediate the infection as additional malicious components could have been installed.

Full system compromise on any computer with the package installed or running. Potential exposure and theft of all stored secrets and keys. The attacker may have persistent control beyond the presence of the package itself.

Immediately remove the @meego-progressive/cdk package from all affected systems. Rotate all secrets and keys that were stored on compromised machines using a separate, secure device. Conduct thorough system investigations and consider rebuilding affected systems to ensure complete removal of malicious components. No official patch or fix is available as this is a malicious package rather than a vulnerability in legitimate software.