The big256-ts package versions 5.0.3 and 5.0.4 distributed via npm include malicious code that compromises any computer on which it is installed or run. This compromise potentially grants full control to an attacker. Due to the severity of the compromise, all stored secrets and keys on the affected system must be rotated from a different, secure machine. Removal of the package alone is insufficient to ensure system integrity, as additional malicious components may persist.

Any system with big256-ts versions 5.0.3 or 5.0.4 installed or running is considered fully compromised. Attackers may have gained full control over the system, risking exposure or theft of all stored secrets and keys. The compromise extends beyond the package itself, potentially involving persistent malicious software.

Remove the big256-ts package versions 5.0.3 and 5.0.4 immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted computer. Because the system may remain compromised even after package removal, consider rebuilding or thoroughly cleaning the affected system to ensure all malicious components are eradicated.