The ts-lint-builders package version 1.0.5 distributed via npm includes malicious code that, when installed or executed, fully compromises the host system. This compromise allows an attacker to gain full control, potentially exfiltrating secrets and keys stored on the machine. Due to the severity of the compromise, remediation requires not only removal of the package but also rotation of all credentials from a different, trusted environment. No CVSS score or official patch is available, and no known exploits in the wild have been reported.

Any system with ts-lint-builders version 1.0.5 installed or running is considered fully compromised. Attackers may have gained full control over the system, risking exposure and theft of sensitive data including secrets and keys. The compromise is severe enough that removing the package alone does not ensure elimination of all malicious artifacts.

Remove the ts-lint-builders package version 1.0.5 immediately. Rotate all secrets and keys stored on the compromised machine from a separate, secure computer. Due to the full compromise, additional forensic analysis and system restoration from a trusted backup are recommended. No official patch or fix is available; therefore, avoid using this package version entirely.