The colder-cli package on npm has been identified as containing malicious code that fully compromises affected systems. According to the source advisory, any computer with this package installed or running should be considered fully compromised. Attackers may gain complete control, potentially accessing all stored secrets and keys. The advisory warns that simply removing the package may not remove all malicious artifacts, indicating persistence mechanisms or additional payloads may be involved. No CVSS score or patch information is available, and no known exploits in the wild have been reported yet.

Full system compromise on any computer with the colder-cli package installed or executed. Potential exposure and theft of all secrets and keys stored on the machine. Persistence of malicious code beyond package removal is possible, increasing risk of ongoing unauthorized access.

Remove the colder-cli package immediately from all affected systems. Rotate all secrets and keys that were stored or used on the compromised machines, performing this rotation from a separate, trusted device. Because full system compromise is possible, consider a full system reinstallation or forensic analysis to ensure removal of all malicious components. Monitor for any suspicious activity related to the compromise.