Malicious code in big-tss (npm)

big-tss@5.0.5 is a trojan-dropper package published to npm that impersonates the popular big.js arbitrary-precision math library. The malicious package ships upstream big.js source code with an injected code block at the top of the main module that attempts to load and execute npm-doc-dev, a package outside the big.js publisher's control.

When any code requires 'big-tss', the injected code synchronously loads and executes the top-level code of npm-doc-dev and calls a method on it. A bare try/catch block swallows any failures, ensuring the malicious load occurs silently without raising errors.

The package.json declares a different dependency name, npm-dc-dev, than the code actually requires (npm-doc-dev), creating a divergence between the declared dependency tree and the modules actually loaded at import time. This combination of name resemblance to big.js, dependency confusion, and silent error handling forms a classic trojan-dropper pattern enabling arbitrary code execution on the installer's machine.

The incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-hhrc-7829-98qq.