The bn-eslint.js package version 8.0.5 distributed via npm contains malicious code that fully compromises the host system. According to the source advisory, installation or execution of this package results in a complete system compromise, potentially allowing an attacker full control. The advisory strongly recommends immediate rotation of all secrets and keys from a separate, secure machine. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors introduced by the attacker.

Any system with bn-eslint.js version 8.0.5 installed or running is considered fully compromised. Attackers may have gained full control over the system, risking exposure or theft of all stored secrets and keys. The integrity and confidentiality of the affected system and its data cannot be assured without comprehensive remediation.

Remove the bn-eslint.js package version 8.0.5 immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Because the system may be fully compromised, consider rebuilding or restoring the system from a known good backup to ensure complete removal of malicious software. No official patch or fix is available; the package itself is malicious.