The color-cli-log package versions 2.0.0 and 2.1.0 distributed via npm contain malicious code that compromises the host system. According to the source advisory, installation or execution of this package results in full system compromise, potentially allowing an attacker to gain complete control. Due to the severity of the compromise, simply uninstalling the package may not remove all malicious artifacts. The advisory recommends immediate rotation of all secrets and keys from a trusted environment to mitigate potential credential theft or misuse.

Systems with color-cli-log versions 2.0.0 or 2.1.0 installed are fully compromised, risking exposure of all secrets and keys stored on the system. Attackers may have persistent access and control, making data theft, credential compromise, and further malicious activity highly likely. Removal of the package alone does not ensure eradication of the threat.

Remove the color-cli-log package versions 2.0.0 and 2.1.0 immediately. Rotate all secrets, keys, and credentials from a separate, uncompromised system to prevent misuse. Conduct a thorough investigation and remediation of the affected system, as full compromise is indicated and residual malicious software may remain. No official patch or fix is available; the package should be considered untrusted and avoided.