The 'syncora' npm package version 0.2.0 is identified as containing malicious code that compromises the host system completely. According to the source advisory, any system with this package installed should be considered fully compromised, with potential unauthorized access to stored secrets and keys. The advisory warns that removing the package may not remove all malicious artifacts, indicating persistent or additional malware may have been installed. No CVSS score or detailed technical exploit information is provided. No known exploits in the wild have been reported. The package is not a cloud service, so remediation depends on user action.

Full system compromise on any computer with 'syncora' version 0.2.0 installed. Potential exposure and theft of all stored secrets and keys on the affected system. Persistence of malicious software beyond the presence of the package itself is possible, increasing the risk of ongoing unauthorized access and control.

Remove the 'syncora' package version 0.2.0 immediately from all affected systems. Consider all affected systems fully compromised and rotate all secrets and keys stored on those systems using a separate, trusted device. Because removal of the package may not eliminate all malicious software, a full system reinstallation or forensic analysis is recommended to ensure complete remediation. No official patch or fix is available for this malicious package.