The sjs-biginteger npm package, published by a throwaway account, is a malicious typosquat of the legitimate big.js package. It includes a hidden dependency (sjs-lint-build1) that runs a postinstall script to establish persistent unauthorized SSH access by adding the attacker’s SSH public key to authorized_keys and opening port 22. It then harvests sensitive credentials and configuration files (.env, Solana id.json, config.toml) along with system fingerprints and exfiltrates this information to attacker-controlled C2 servers hosted on Vercel and disguised as Cloudflare services. This results in full system compromise. Removal of the package alone does not guarantee remediation due to potential persistence mechanisms.

Systems with sjs-biginteger versions 5.0.5 or 5.0.6 installed are fully compromised. The attacker gains persistent SSH access, can open firewall ports, and exfiltrate sensitive credentials and configuration data. This compromises confidentiality, integrity, and potentially availability of the affected systems. All secrets and keys stored on the compromised system should be considered exposed and rotated immediately from a secure environment.

Immediate removal of the sjs-biginteger package versions 5.0.5 and 5.0.6 is required. However, because the attacker gains persistent SSH access and collects sensitive data, removal alone may not fully remediate the compromise. All secrets, SSH keys, and credentials stored on the affected system must be rotated from a different, secure machine. Conduct a thorough incident response to identify and remove any additional backdoors or persistence mechanisms. Monitor for suspicious SSH access and network activity. Patch status is not applicable as this is a malicious package, not a vulnerability with an official fix.