The aone-cloud-cli package distributed via npm has been identified as containing malicious code that fully compromises affected systems. According to the source advisory, any computer with this package installed should be considered fully compromised, with attackers potentially having full control. The package's presence risks exposure of all secrets and keys stored on the system. Removal of the package alone is insufficient to ensure system integrity, as additional malicious software may persist. There is no CVSS score available for this threat, and no known exploits in the wild have been reported at this time.

Full system compromise on any computer with the aone-cloud-cli package installed. All secrets and keys stored on the compromised system are at risk and should be considered exposed. The attacker may have persistent access beyond the presence of the package itself.

Remove the aone-cloud-cli package immediately from all affected systems. Rotate all secrets and keys that were stored on the compromised systems using a separate, trusted computer. Conduct a thorough investigation and remediation of the affected systems, as removal of the package alone does not guarantee elimination of all malicious components.