The npm package @bikli/bikli in versions 1.1.5, 1.1.6, 1.1.8, and 1.1.10 has been identified as containing malicious code. According to the GHSA malware source, any system with this package installed or running should be considered fully compromised, with potential full control given to an attacker. The Amazon Inspector source did not find static or traced indicators of supply-chain attack behavior such as lifecycle scripts fetching remote content or credential scraping, but the GHSA malware advisory indicates severe compromise risk. There is no vendor advisory or patch information available for remediation.

Systems with the affected package versions installed or running are considered fully compromised. Attackers may have gained full control over the system, risking exposure of all stored secrets and keys. The compromise is severe enough that simply removing the package may not remove all malicious software or backdoors introduced. Immediate secret rotation from a clean environment is necessary to mitigate credential exposure.

No official patch or fix is currently documented. Immediate removal of the affected package versions (@bikli/bikli 1.1.5, 1.1.6, 1.1.8, 1.1.10) is recommended. All secrets and keys stored on the compromised system should be rotated immediately from a different, trusted machine. Given the potential full system compromise, consider rebuilding or thoroughly cleaning affected systems to ensure removal of all malicious artifacts.