The 'vantora' package in the npm ecosystem is identified as containing malicious code that fully compromises affected systems. Installation or execution of this package grants an attacker potential full control over the computer, risking exposure of all stored secrets and keys. Due to the nature of the compromise, remediation requires secret rotation from a separate trusted environment. No CVSS score or patch information is available, and no known exploits in the wild have been reported. The vendor has not provided an official patch or advisory, and the package should be removed immediately upon detection.

Systems with the 'vantora' package installed or running are considered fully compromised, risking exposure and theft of all stored secrets and keys. The attacker may have persistent access beyond the presence of the package itself, making the compromise severe and difficult to fully remediate without comprehensive incident response.

Remove the 'vantora' package immediately from all affected systems. Rotate all secrets and keys that were stored on the compromised machines, performing this rotation from a separate, trusted environment. Conduct a thorough incident response to identify and remediate any persistent malicious components. Patch status is not confirmed; no official fix or vendor advisory is available. Monitor for any updates from the vendor or security community.