The 'calvora' package in the npm ecosystem is identified as malicious software. According to the source details, any system with this package installed should be considered fully compromised. The malicious code potentially grants full control of the affected computer to an external attacker. Due to the severity of the compromise, simply uninstalling the package may not remove all malicious artifacts. The advisory recommends immediate rotation of all secrets and keys from a separate, secure environment to mitigate ongoing risk.

Full system compromise on any computer with the 'calvora' package installed or running. Potential unauthorized access to all secrets and keys stored on the system. Removal of the package alone may not restore system integrity, as additional malicious software may persist.

Remove the 'calvora' package immediately from all affected systems. Rotate all secrets and keys that were stored on the compromised systems from a different, secure computer. Consider the affected systems fully compromised and perform thorough incident response and remediation beyond package removal. Patch status is not applicable as this is a malicious package, not a vulnerability with a vendor fix.