The ts-esys package (version 0.0.5) published on npm impersonates the legitimate big.js library by copying its metadata and README, falsely claiming no dependencies. However, it includes a hidden runtime dependency on websocket-slot, which executes code on every import or require of ts-esys. Errors from this execution are silently caught and ignored, concealing the malicious behavior. This pattern is a known supply-chain attack technique that allows arbitrary code execution on any system that installs the package. The malicious code compromises the system, potentially exposing all stored secrets and keys.

Any system that installs or runs ts-esys version 0.0.5 is considered fully compromised. The malicious code executes with the privileges of the importing process, potentially allowing attackers to access or exfiltrate sensitive data, including secrets and keys. Removing the package does not guarantee full remediation, as the attacker may have established persistent control or installed additional malware.

There is no official patch or fix available for this malicious package. The recommended mitigation is to immediately remove ts-esys version 0.0.5 from all systems. All secrets and keys stored on affected systems should be rotated from a separate, uncompromised environment. Monitor for any signs of further compromise and consider a full system rebuild if necessary.