The chalks-logger package on npm, specifically versions 1.0.9, 1.1.0, 1.1.1, 1.1.2, and 1.1.3, contains embedded malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker complete control. Due to the severity of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors introduced. Immediate secret and key rotation from a secure environment is strongly advised.

Any system with the affected versions of chalks-logger installed or running is considered fully compromised. This includes potential unauthorized access, data exfiltration, and persistent backdoors. All credentials and secrets stored on the compromised system are at risk and must be rotated. The malicious code may have installed additional malware beyond the package itself.

Remove the chalks-logger package immediately from all affected systems. Because the system is likely fully compromised, perform a thorough incident response including forensic analysis and system restoration from known good backups. Rotate all secrets and keys that were stored or used on the compromised system from a separate, secure machine. No official patch or fix is available; remediation relies on removal and recovery procedures.