The sjs-lint-build1 npm package (version 1.0.4) is a typosquatting malicious package that includes a postinstall hook which downloads an attacker SSH public key and appends it to ~/.ssh/authorized_keys, thereby granting the attacker persistent remote access via SSH. It also opens firewall port 22 to allow incoming connections. The malware collects sensitive information such as SSH keys, environment variables, .env files, Solana id.json, config.toml, and system fingerprints, then exfiltrates this data to two Vercel-hosted C2 domains masquerading as Cloudflare services. Due to the nature of the compromise, affected systems should be considered fully compromised.

Systems with sjs-lint-build1 version 1.0.4 installed are fully compromised. The attacker gains persistent SSH access, can bypass firewall restrictions by opening port 22, and steals sensitive credentials and configuration data. This leads to complete loss of confidentiality and potential further system control by the attacker. Removal of the package alone does not ensure eradication of the attacker presence.

No official patch or fix is available. Immediate removal of the sjs-lint-build1 package version 1.0.4 is required. However, because the attacker gains persistent SSH access and collects sensitive data, all secrets and keys stored on the compromised system must be rotated from a separate, trusted machine. Consider rebuilding or restoring the affected system from a known good backup to ensure full remediation.