The picocolor-logger package in npm versions 1.0.0 through 1.0.2 contains embedded malicious code that compromises the host system. Installation or execution of this package potentially grants full control to an attacker. Due to the nature of the compromise, simply uninstalling the package may not eradicate all malicious components or backdoors introduced. Immediate secret and key rotation from unaffected systems is required to mitigate ongoing risk.

Systems with the affected picocolor-logger package installed are considered fully compromised, risking exposure of all stored secrets and keys. The attacker may have persistent control beyond the presence of the package itself, leading to potential data theft, unauthorized access, and further system manipulation.

Remove the picocolor-logger package immediately from all affected systems. Rotate all secrets and keys stored on compromised systems using a separate, trusted computer. Due to the potential persistence of malicious software beyond the package, consider full system reimaging or forensic analysis to ensure complete remediation. No official patch or fix is available; mitigation relies on removal and secret rotation.