big-tss (npm) · Malicious Code
Affects big-tssSource GCVE Database
Malicious package : remove big-tss and rotate any secrets on hosts that installed it.
Data as of 19 Aug 2026, 16:40 UTC
Malicious package
Published to npm · OSV MAL-2026-13613
What to do
Remove big-tss from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmbig-tss | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package big-tss@5.0.5 impersonates the popular big.js library but contains malicious code that silently loads and executes a third-party package named npm-doc-dev when imported. This behavior is hidden by a try/catch block that suppresses errors, and the declared dependency (npm-dc-dev) differs from the actually required package, forming a trojan-dropper pattern. This results in arbitrary code execution on the machine of anyone importing big-tss@5.0.5.