[email protected] is a malicious npm package that mimics the legitimate big.js arbitrary-precision math library. It injects a code block at the top of its main module that attempts to require and execute code from a third-party package named npm-doc-dev. The package.json declares a dependency on npm-dc-dev, which differs from the required npm-doc-dev, causing a discrepancy in the dependency tree. The injected code is wrapped in a try/catch block that suppresses any errors, allowing the malicious code to execute silently upon import. This trojan-dropper pattern enables arbitrary code execution on the installer's machine whenever the package is imported.

Any user who imports [email protected] will have arbitrary code from the third-party npm-doc-dev package executed on their machine without their knowledge. This can lead to compromise of the development environment, potential data theft, or further malware deployment. The malicious behavior is stealthy due to error suppression and dependency name obfuscation.

No official patch or remediation is currently documented. Users should avoid installing or importing [email protected]. Verify package authenticity before use and prefer the legitimate big.js library. Monitor for updates from the package maintainers or npm security advisories for any official fixes or removal actions. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.