The avatar-forge package in the npm ecosystem has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker to gain complete control. Due to the severity of the compromise, secrets and keys stored on the affected machine must be rotated from a separate, secure environment. Removal of the package does not guarantee eradication of all malicious artifacts or backdoors introduced by the attacker.

Full system compromise on any computer with the avatar-forge package installed or running. Potential exposure and theft of all stored secrets and keys. Persistent malicious presence may remain even after package removal, risking ongoing unauthorized access and control.

Immediately remove the avatar-forge package from all affected systems. Rotate all secrets, keys, and credentials from a separate, uncompromised computer. Conduct a thorough investigation and remediation of the affected systems to identify and remove any persistent malicious software or backdoors. There is no known official patch or fix for this malicious package; remediation relies on removal and system recovery procedures.