The cjs-biginteger npm package, specifically versions 5.0.3, 5.0.5, and 5.0.6, was identified as malicious due to its involvement in a typosquatting campaign targeting the legitimate big.js package. The malicious code implants an SSH backdoor and steals sensitive information such as credentials and crypto wallets. The compromise is severe enough that any system with this package installed should be treated as fully compromised. Immediate secret rotation from a different, uncompromised system is recommended. There is no vendor advisory or patch available, and the threat is not a cloud service. The package should be removed, but full remediation may require rebuilding the system due to potential persistent malware.

Systems with the affected versions of cjs-biginteger installed are fully compromised, allowing attackers to implant SSH backdoors and steal credentials and cryptocurrency wallets. This leads to complete loss of system confidentiality and integrity. The presence of this package indicates a high risk of unauthorized access and data theft.

Remove the cjs-biginteger package versions 5.0.3, 5.0.5, and 5.0.6 immediately. Consider the system fully compromised and perform secret and key rotation from a separate, clean device. Because the package implants persistent backdoors, removing it may not fully restore system integrity; a full system rebuild or forensic analysis is recommended. No official patch or fix is available; rely on removal and secret rotation as primary mitigations.