The ts-einkle-slot package published on npm mimics the legitimate big.js package by copying its source and metadata to spoof the publisher identity. However, its CommonJS and ESM entrypoints include injected code that immediately requires and invokes a method from the node-slot module, a transitive dependency introduced solely by this malicious package. This causes the node-slot code to execute upon any import or require of ts-einkle-slot, potentially delivering harmful effects controlled by the attacker. The package's advertised purpose does not justify loading node-slot, indicating malicious intent.

Any project that installs or imports [email protected] will execute attacker-controlled code from the node-slot dependency without user awareness. This can lead to compromise of the host environment or supply chain contamination. The malicious code is designed to silently swallow errors to avoid detection and maintain functionality as a drop-in replacement for big.js, increasing the risk of unnoticed exploitation.

Avoid installing or using the ts-einkle-slot package, especially version 0.0.8. Remove any instances of this package and its transitive dependencies from your projects and lockfiles. Since no official patch or fix is available, rely on package source verification and use trusted package registries. Monitor for any updates or advisories from npm or security databases regarding this package.