The open-worker-cli package distributed via npm has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially exposing all stored secrets and keys. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious components or backdoors introduced by the attacker. Immediate secret and key rotation from a separate, uncompromised system is strongly recommended.

Full system compromise on any computer with the package installed or running. All secrets and keys stored on the compromised system are at risk and should be considered exposed. The attacker may maintain persistent access beyond the presence of the package itself.

Remove the open-worker-cli package immediately. Rotate all secrets and keys from a different, trusted system to prevent unauthorized access. Because the system may remain compromised even after removal, consider a full system rebuild or forensic analysis to ensure eradication of malicious software.