The bigint.os package versions =5.0.5, =5.0.6, =5.0.7, and =5.0.8 distributed via npm contain malicious code that fully compromises affected systems. Installation of these versions can lead to complete control by an attacker, necessitating secret and key rotation from a separate trusted environment. Due to the nature of the compromise, simply uninstalling the package may not eliminate all malicious artifacts or backdoors.

Systems with any of the affected bigint.os versions installed should be considered fully compromised. Attackers may have gained complete control, potentially exposing all stored secrets and keys. This level of compromise requires immediate security incident response, including key rotation from a secure environment and thorough system remediation.

Remove the affected bigint.os package versions immediately. Rotate all secrets and keys from a different, uncompromised computer. Because full system compromise is possible, additional forensic analysis and remediation may be necessary beyond package removal. No official patch or fix is indicated; therefore, avoid using these versions entirely.