The @orbis-lr-sdk/orbis-lr-sdk npm package is identified as malicious software that, when installed or executed, compromises the host system completely. This compromise includes potential unauthorized access and control by an external entity. Due to the severity of the compromise, simply uninstalling the package may not remove all malicious components or backdoors. The advisory recommends treating any system with this package as fully compromised and taking immediate remediation steps such as rotating secrets and keys from a secure, unaffected machine.

Any system with this package installed or running is considered fully compromised, risking exposure of all stored secrets and keys. Attackers may have persistent access beyond the presence of the package itself, leading to potential data theft, system control, and further malicious activity.

Remove the @orbis-lr-sdk/orbis-lr-sdk package immediately. Rotate all secrets and keys stored on the affected system from a separate, secure computer. Because full system compromise is likely, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components.