The npm package chalk-prettier versions 1.0.8 and 1.0.9 have been identified as containing malicious code that compromises the host system. Installation or execution of these versions can lead to full system compromise, allowing attackers to potentially access all stored secrets and keys. Due to the nature of the compromise, simply removing the package does not guarantee elimination of all malicious artifacts. This threat is classified as a malicious package rather than a traditional vulnerability with a CVSS score. No known exploits in the wild have been reported as of the publication date.

Systems with chalk-prettier versions 1.0.8 or 1.0.9 installed or running are considered fully compromised. Attackers may have gained full control of the system, including access to sensitive secrets and keys. This can lead to unauthorized data access, credential theft, and further system compromise. Removal of the package alone may not restore system integrity.

Remove the chalk-prettier package versions 1.0.8 and 1.0.9 immediately from all affected systems. Rotate all secrets and keys stored on compromised machines using a separate, secure system. Because full system compromise is possible, consider rebuilding or thoroughly auditing affected systems to ensure all malicious components are eradicated. Monitor for any suspicious activity related to this compromise.