The clx-cookieparser npm package has been identified as containing malicious code that compromises any computer on which it is installed or executed. The compromise is severe enough that full control may have been given to an external attacker. Due to the nature of the compromise, simply uninstalling the package does not ensure removal of all malicious artifacts. The advisory recommends treating affected systems as fully compromised and rotating all secrets and keys from a separate, secure environment.

Systems with the clx-cookieparser package installed or running are considered fully compromised, potentially allowing attackers complete control over the system. All stored secrets and keys on the compromised system are at risk and must be rotated immediately. Removal of the package does not guarantee full remediation due to possible persistence mechanisms or additional malware installed.

Remove the clx-cookieparser package immediately. Treat the affected system as fully compromised and rotate all secrets and keys from a different, secure computer. Because full remediation cannot be guaranteed by package removal alone, consider rebuilding or restoring the system from a known good backup.