The npm package @bikli/bikli versions 1.1.5, 1.1.6, 1.1.8, and 1.1.10 contain malicious code. Installation or execution of these versions may result in full compromise of the affected system. Secrets and keys stored on the compromised system should be rotated immediately from a different, trusted machine. Removal of the package does not guarantee complete eradication of the malicious presence. No specific patch or fix is currently documented.