The 'calmora' package in the npm ecosystem is identified as malicious. Installing or running this package results in a full compromise of the host computer, potentially allowing attackers to access sensitive information such as secrets and keys. Due to the nature of the compromise, simply removing the package may not eradicate all malicious components introduced. This threat is documented under OSV ID MAL-2026-11009 and GHSA advisory GHSA-7wwx-476f-c8gm. No CVSS score or patch information is available.

Full system compromise on any computer with the 'calmora' package installed or running. Attackers may gain access to all stored secrets and keys, leading to potential data breaches and further system exploitation. The persistence of malicious software beyond package removal increases the risk and difficulty of remediation.

Remove the 'calmora' package immediately from all affected systems. Rotate all secrets and keys from a different, uncompromised computer to prevent unauthorized access. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected systems. No official patch or fix is available; remediation relies on removal and secret rotation.