The txs-builder-lib npm package versions 1.0.1, 1.0.2, and 1.0.3 have been identified as containing malicious code or relying on a dependency that contains malicious code. According to sources including Amazon Inspector and the GitHub Security Advisory for malware, any system with this package installed or running should be considered fully compromised. The malicious code presence implies that attackers may have gained full control over the system, necessitating immediate secret and key rotation from a secure environment. Removal of the package alone does not guarantee eradication of the malware due to potential persistence mechanisms.

Systems with txs-builder-lib versions 1.0.1, 1.0.2, or 1.0.3 installed are at risk of full compromise. Attackers may have gained complete control over the affected computer, potentially exposing all stored secrets and keys. This level of compromise can lead to unauthorized access, data theft, and further malicious activities. The presence of malicious code in the package means that the integrity and confidentiality of the system are severely impacted.

Remove the txs-builder-lib package versions 1.0.1, 1.0.2, and 1.0.3 immediately from affected systems. Rotate all secrets and keys stored on the compromised computer from a separate, secure device. Because full control of the system may have been given to an attacker, consider rebuilding or fully reimaging the affected system to ensure complete removal of malicious software. Monitor for any signs of persistent compromise. Patch status is not confirmed; check vendor or repository advisories for updates or safer package versions.