The 'clavuepro' package in the npm ecosystem is identified as containing malicious code that fully compromises affected computers. According to the source advisory, any system with this package installed should be considered fully compromised, with potential unauthorized control by an external entity. The advisory warns that removing the package alone may not remove all malicious artifacts, and that secrets and keys stored on the system must be rotated immediately from a different, secure computer. No patch or remediation fix is available, and no known exploits in the wild have been reported at this time.

Full system compromise on any computer with the 'clavuepro' package installed or running. Potential exposure and theft of all secrets and keys stored on the compromised system. Persistent malicious presence may remain even after package removal, indicating a high risk of ongoing unauthorized access and control.

Remove the 'clavuepro' package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised systems from a separate, secure computer. Because removal of the package may not eliminate all malicious software, consider rebuilding or thoroughly cleaning affected systems. No official patch or fix is available; follow vendor or ecosystem advisories for updates.