The sjs-builders package version 1.0.4 distributed via npm contains malicious code that, when installed or executed, fully compromises the host system. This compromise allows an attacker to gain complete control, potentially accessing all secrets and keys stored on the machine. Due to the severity of the compromise, simply uninstalling the package is insufficient to ensure system integrity, as additional malicious artifacts may persist.

Any system with sjs-builders version 1.0.4 installed or running is considered fully compromised. Attackers may have gained full control over the system, exposing all stored secrets and keys. This level of compromise necessitates immediate secret/key rotation from a trusted environment and thorough system remediation.

Remove the sjs-builders package version 1.0.4 immediately. Rotate all secrets and keys from a separate, uncompromised system. Conduct a full system investigation and remediation, as removing the package alone does not guarantee removal of all malicious components. Monitor for any signs of persistent compromise.