The @bikli/cli npm package versions 1.0.9, 1.1.0, and 1.1.1 have been identified as malicious. While automated static and behavioral scans did not detect install-time code execution or credential theft mechanisms, the GHSA advisory indicates that the package effectively compromises any system on which it is installed or running. This implies the presence of malicious code capable of full system compromise, warranting urgent remediation actions.

Systems with the affected @bikli/cli package versions installed or running should be considered fully compromised. All secrets and keys stored on such systems are at risk and must be rotated immediately from a secure, uncompromised environment. Removing the package alone may not eliminate all malicious components introduced by the package, as full control may have been granted to an attacker.

Remove the affected versions (=1.0.9, =1.1.0, =1.1.1) of the @bikli/cli package immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Due to the potential for persistent compromise, consider rebuilding the affected system to ensure complete remediation. No official patch or fix is available; the package itself is malicious.