The sjs-builder package versions 1.0.4 and 1.0.5 distributed via npm contain embedded malicious code. Installation or execution of these versions results in a full compromise of the host system, potentially allowing attackers complete control. Because the compromise may extend beyond the package itself, simply uninstalling the package is insufficient to restore system integrity. This threat is identified as MAL-2026-6876 and is tracked under GHSA-27jm-f99f-wqr4. No CVSS score or known exploits in the wild are reported.

Any system with sjs-builder versions 1.0.4 or 1.0.5 installed or running is considered fully compromised. Attackers may have gained full control over the system, including access to stored secrets and keys. This level of compromise poses a severe risk to confidentiality, integrity, and availability of the affected system and any connected infrastructure.

Remove the affected sjs-builder package versions 1.0.4 and 1.0.5 immediately. Rotate all secrets, keys, and credentials from a different, trusted system to prevent further unauthorized access. Because the system may be fully compromised, consider rebuilding or restoring the system from a known clean backup. No official patch or fix is available; remediation relies on removal and credential rotation.