The npm package awesome-cli-logger versions 1.0.0 and 1.2.0 have been identified as containing malicious code that compromises the host system. Installation or execution of this package can lead to full system compromise, including potential unauthorized access to secrets and keys. The malicious nature of the package means that simply uninstalling it may not remove all malicious artifacts or backdoors introduced. This threat is documented under MAL-2026-6799 and GHSA-4j38-wfq5-cfxw. No CVSS score or known exploits in the wild are reported.

Systems with the affected versions of awesome-cli-logger installed are considered fully compromised. Attackers may have gained full control over the system, risking exposure and theft of all stored secrets and keys. The compromise may persist even after removal of the package, necessitating comprehensive remediation steps.

Remove the malicious awesome-cli-logger package immediately. Rotate all secrets, keys, and credentials from a separate, uncompromised system to prevent further unauthorized access. Because full system compromise is possible, consider rebuilding or thoroughly cleaning affected systems. No official patch or fix is available; the package should be uninstalled and replaced with trusted alternatives.