The @omniwatch-wick/cli npm package version 0.1.2 includes code that requires modules such as child_process, os, http, and https to gather host identifiers including user info, hostname, and platform. It sends this information via POST requests to hardcoded, non-first-party Cloudflare Workers endpoints controlled by the package publisher. This exfiltration behavior indicates malicious intent, functioning as a reconnaissance and data collection beacon during installation. According to the ghsa-malware source, any system with this package installed should be considered fully compromised, with secrets and keys rotated immediately. The package removal does not guarantee full remediation due to potential additional malware.

Systems with @omniwatch-wick/cli version 0.1.2 installed are at high risk of full compromise. Sensitive host and user identity data is exfiltrated to attacker-controlled servers. Attackers may have gained persistent access, and all secrets and keys stored on the compromised system should be considered exposed and rotated. The presence of this package indicates a severe security breach with potential for further undetected malicious activity.

Immediate removal of the @omniwatch-wick/cli package version 0.1.2 is required. However, removal alone is insufficient due to the likelihood of additional malware. All secrets and keys stored on the compromised system must be rotated from a separate, trusted machine. Conduct a thorough investigation and system remediation to identify and eliminate any residual malicious software. Monitor for any unusual activity and consider rebuilding the affected system if full remediation cannot be assured.