The myclaude-code npm package has been identified as containing malicious code that fully compromises any system where it is installed or executed. The compromise allows an attacker to gain full control over the affected computer. Due to the severity of the compromise, all credentials and secrets stored on the system must be rotated from a separate, uncompromised device. Removal of the package alone is insufficient to ensure the system is clean, as additional malicious software may have been installed.

Any system with the myclaude-code package installed or running should be considered fully compromised. Attackers may have gained complete control, risking exposure or theft of all stored secrets and keys. The integrity and confidentiality of the system and its data cannot be trusted.

Remove the myclaude-code package immediately. Rotate all secrets and keys from a different, uncompromised computer. Because the system may be fully compromised, consider rebuilding or restoring the system from a known good backup. No official patch or fix is available; remediation relies on removal and credential rotation.