MalwarePublished 19 Jun 2026Updated 8 Jul 2026

ts-big-ecro (npm) · Malicious Code

Affects ts-big-ecroSource GCVE Database

Malicious package : remove ts-big-ecro and rotate any secrets on hosts that installed it.

Data as of 9 Jul 2026, 10:05 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6199

What to do

Remove ts-big-ecro from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmts-big-ecro	Affected =0.1.0 =3.8.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The ts-big-ecro npm package is a malicious typosquatting clone of the legitimate big.js library. It impersonates the original by copying its code and metadata but injects attacker-controlled code that executes on every import or require. This code loads an undeclared and suspicious dependency, parket-helper, which can execute arbitrary code. The package's declared dependency server-parket is unrelated to its stated purpose, indicating a dependency-confusion trojan-loader pattern. Installing or running this package compromises the host system, potentially exposing all stored secrets and keys.

Impact

Any computer with ts-big-ecro installed or running is considered fully compromised. The attacker-controlled code executes during package import, potentially allowing arbitrary code execution. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

Defensive guidance

The recommended mitigation is to immediately remove the ts-big-ecro package from all systems. Rotate all secrets, keys, and credentials that were stored or used on any affected system from a trusted, uncompromised environment. Audit systems for signs of further compromise or persistence mechanisms. Avoid installing packages from untrusted or suspicious sources and verify package authenticity before use.

Summary

ts-big-ecro is a malicious npm package that mimics the legitimate big.js library (version 7.0.1) by copying its code and metadata to deceive users. It includes an attacker-inserted code block that runs at import time, which attempts to load an undeclared module named parket-helper. This module is unrelated to the package's stated functionality and is not documented, indicating malicious intent. The package also declares a suspicious dependency, server-parket, unrelated to arbitrary-precision arithmetic, reinforcing the trojan-loader pattern typical of dependency confusion attacks. Any system that installs or runs ts-big-ecro executes attacker-controlled code, leading to full system compromise.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 9 Jul 2026, 10:05 UTC

Technical details

References

Community reviews