The npm package @bikli/cli versions 1.0.9, 1.1.0, and 1.1.1 contain malicious code. Installation or execution of these versions may fully compromise the host system, potentially exposing all stored secrets and keys. Although no static or behavioral evidence of install-time code execution or backdoors was detected by Amazon Inspector, the GHSA advisory warns that any system with this package should be considered fully compromised. Immediate removal and secret rotation are strongly recommended.