The 'cdocs-data' package in the npm ecosystem is identified as containing malicious code that compromises the host system completely. Installation or execution of this package results in full system compromise, potentially allowing an attacker to control the affected computer. Due to the severity of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors. The advisory recommends rotating all secrets and keys from a separate, secure device to mitigate ongoing risk.

Full compromise of any computer with the 'cdocs-data' package installed or running. All stored secrets and keys on the compromised system are at risk and should be considered exposed. The attacker may maintain persistent access beyond removal of the package.

Remove the 'cdocs-data' package immediately from affected systems. Rotate all secrets and keys stored on the compromised computer using a different, secure machine. Because full control of the computer may have been given to an attacker, additional forensic analysis and remediation may be necessary. No official patch or fix is available; the best mitigation is removal and credential rotation.