The aone-cloud-cli package distributed via npm is identified as containing malicious code that fully compromises affected systems. The compromise includes potential unauthorized access and control over the computer, putting all stored secrets and keys at risk. Removal of the package alone does not guarantee elimination of all malicious components, indicating possible persistence mechanisms. This threat is classified as a malicious package rather than a traditional vulnerability and has no CVSS score assigned.

Any system with the aone-cloud-cli package installed or running should be considered fully compromised. Attackers may have gained full control over the system, risking exposure and theft of all stored secrets and keys. The presence of this package undermines system integrity and confidentiality, requiring immediate secret rotation and system remediation.

Remove the aone-cloud-cli package immediately from all affected systems. Rotate all secrets and keys stored on compromised computers using a separate, trusted device. Due to potential persistent malicious software, consider rebuilding or thoroughly cleaning the affected systems. No official patch or fix is available; remediation relies on removal and system recovery procedures.