big-tss version 5.0.5 is a malicious npm package impersonating the popular big.js arbitrary-precision math library. It includes an injected code block at the top of its main module that synchronously requires and executes code from a third-party package named npm-doc-dev, which is not declared in its package.json (which instead declares npm-dc-dev). This discrepancy and the silent failure handling form a trojan-dropper pattern, enabling arbitrary code execution on any system that imports [email protected]. This behavior is designed to evade detection by hiding the actual dependency and suppressing errors during module loading.

Any user or system importing [email protected] will execute arbitrary code from the npm-doc-dev package without their knowledge, potentially compromising the security and integrity of the environment. This can lead to unauthorized actions or persistence of malicious code on the affected machine. The malicious code is executed synchronously upon import, increasing the risk of immediate compromise.

No official patch or remediation is currently documented. Users should avoid installing or importing [email protected]. Verify dependencies carefully and prefer the legitimate big.js package. Monitor for updates from the package maintainers or npm security advisories for any official fixes or removals. Since this is a malicious package impersonation, removing the package and replacing it with the correct library is recommended.