The clavue-agent-sdk package distributed via npm is identified as containing malicious code. Installation or execution of this package results in a full compromise of the affected system, potentially allowing an attacker complete control. Due to the severity of the compromise, all secrets and keys stored on the system must be rotated immediately from a different, uncompromised device. Simply uninstalling the package is insufficient to ensure removal of all malicious artifacts or backdoors introduced by the package.

Any system with the clavue-agent-sdk package installed or running should be considered fully compromised. Attackers may have gained full control over the system, risking exposure of all stored secrets and keys. The compromise may persist even after package removal, indicating potential persistence mechanisms or additional malware installed by the malicious package.

Remove the clavue-agent-sdk package immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure computer. Because full system compromise is likely, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components. Monitor for any suspicious activity and avoid using the compromised system for sensitive operations until fully remediated.