The svelte-cache-kit package version 1.0.0 on npm is identified as containing malicious code. Although static analysis and runtime behavior during installation or import do not show direct malicious actions such as credential access or network exfiltration, the package is considered fully compromising to any host where it is installed. The presence of this package implies that an attacker may have gained full control over the affected system. Immediate secret and key rotation from a different, uncompromised machine is required, and the package should be removed. However, removal may not fully eradicate all malicious components introduced by the package.

Any system with svelte-cache-kit version 1.0.0 installed should be treated as fully compromised. Attackers may have obtained full control, potentially exposing all secrets and keys stored on the system. The compromise could lead to unauthorized access, data theft, and persistent malicious presence beyond the package itself.

Remove the svelte-cache-kit package version 1.0.0 immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure computer. Because full control of the system may have been given to an attacker, consider rebuilding or thoroughly cleaning the affected system to ensure complete removal of malicious software. No official patch or fix is available; the package itself is malicious.