The bjs-lint-builder npm package (version 1.0.5) is identified as malicious, involved in a typosquatting campaign mimicking the legitimate big.js package. It contains code that implants an SSH backdoor and steals sensitive information including credentials and crypto wallets. The presence of this package on a system implies a full compromise, with attackers potentially having persistent access. The package should be removed, but because of the severity of the compromise, additional remediation steps such as secret rotation and system reimaging may be necessary.

Systems with bjs-lint-builder version 1.0.5 installed are fully compromised. Attackers gain persistent access via an SSH backdoor and can exfiltrate credentials and cryptocurrency wallets. This leads to loss of confidentiality, integrity, and control over the affected system. The compromise may extend beyond the package itself, affecting all secrets stored on the machine.

Remove the bjs-lint-builder package version 1.0.5 immediately. Rotate all secrets, credentials, and cryptographic keys from a secure, uncompromised system. Consider full system reimaging or restoration from a known good backup to ensure removal of all malicious components. Monitor for any suspicious activity and avoid reinstalling the malicious package. There is no official patch or fix; remediation relies on removal and secret rotation.