ts-big-ecro is a malicious npm package that mimics the legitimate big.js library (version 7.0.1) by copying its code and metadata to deceive users. It includes an attacker-inserted code block that runs at import time, which attempts to load an undeclared module named parket-helper. This module is unrelated to the package's stated functionality and is not documented, indicating malicious intent. The package also declares a suspicious dependency, server-parket, unrelated to arbitrary-precision arithmetic, reinforcing the trojan-loader pattern typical of dependency confusion attacks. Any system that installs or runs ts-big-ecro executes attacker-controlled code, leading to full system compromise.

Any computer with ts-big-ecro installed or running is considered fully compromised. The attacker-controlled code executes during package import, potentially allowing arbitrary code execution. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

No official patch or fix is available for ts-big-ecro as it is a malicious package rather than a vulnerability in legitimate software. The recommended mitigation is to immediately remove the ts-big-ecro package from all systems. Rotate all secrets, keys, and credentials that were stored or used on any affected system from a trusted, uncompromised environment. Audit systems for signs of further compromise or persistence mechanisms. Avoid installing packages from untrusted or suspicious sources and verify package authenticity before use.