The es-lint-builders package in npm versions 1.0.0, 1.0.3, 1.0.4, and 1.0.5 contains malicious code that compromises any computer on which it is installed or executed. This malicious package grants full control to an outside entity, potentially exposing all stored secrets and keys. Due to the severity of the compromise, simply uninstalling the package does not guarantee removal of all malicious artifacts. The advisory recommends treating affected systems as fully compromised and rotating all credentials from a secure environment.

Systems with the affected es-lint-builders package installed are fully compromised, allowing attackers complete control. All secrets and keys stored on these systems are at risk and should be considered exposed. The presence of this package indicates a severe security breach that may persist beyond package removal.

Remove the es-lint-builders package immediately from all affected systems. Treat all affected systems as fully compromised. Rotate all secrets and keys from a separate, secure system to prevent further unauthorized access. There is no official patch or fix; remediation relies on removal and credential rotation.