The color-logger-console package versions 3.1.8 and 3.1.9 distributed via npm include malicious code that grants full control of the infected system to an attacker. This level of compromise means that any sensitive information such as secrets and keys stored on the machine may be exposed or stolen. Due to the severity of the infection, simply uninstalling the package may not remove all malicious artifacts. The advisory recommends treating any system with this package installed as fully compromised and performing secret/key rotation from a clean environment.

Full system compromise on any computer with the affected package installed. Exposure and potential theft of all secrets and keys stored on the system. Persistent malicious presence may remain even after package removal.

Remove the color-logger-console package versions 3.1.8 and 3.1.9 immediately. Rotate all secrets and keys from a separate, uncompromised computer. Treat affected systems as fully compromised and consider rebuilding or thoroughly cleaning the environment. No official patch or fix is available; remediation relies on removal and secret rotation.