The big-numerator package versions 5.0.3 and 5.0.6 distributed via npm contain malicious code that, when installed or executed, results in a full compromise of the host system. This compromise allows attackers to gain control over the affected computer, potentially accessing all stored secrets and keys. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts. The advisory recommends immediate secret/key rotation from a secure environment and removal of the package to mitigate ongoing risk.

Any system with big-numerator versions 5.0.3 or 5.0.6 installed or running is considered fully compromised. Attackers may have gained complete control over the system and access to all stored secrets and keys. This can lead to severe confidentiality and integrity breaches. Removal of the package alone does not ensure full remediation, as additional malicious software may persist.

Remove the affected big-numerator package versions 5.0.3 and 5.0.6 from all systems. Immediately rotate all secrets and keys from a different, uncompromised computer. Because the system is considered fully compromised, further forensic analysis and remediation may be necessary to ensure complete removal of malicious software.