The 'calvuepro' package in the npm ecosystem is identified as malicious software. According to the source advisory, any system with this package installed should be considered fully compromised. The malicious code potentially grants attackers full control over the affected computer, risking exposure of all stored secrets and keys. Immediate rotation of all credentials from a secure, unaffected system is recommended. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts or restore system integrity.

Systems with the 'calvuepro' package installed are fully compromised, allowing attackers potential full control over the machine. All secrets and keys stored on the system are at risk of exposure. The compromise may persist even after removal of the package, indicating possible persistent backdoors or additional malware installed by the malicious package.

Remove the 'calvuepro' package immediately from all affected systems. Rotate all secrets, keys, and credentials from a different, uncompromised computer. Because the system may remain compromised after package removal, consider performing a full system audit or rebuild to ensure complete remediation.