The ts-wross package is a malicious npm package masquerading as the legitimate big.js arbitrary-precision arithmetic library. While its source code is mostly a verbatim copy of big.js v7.0.1, it contains an injected try/catch block that requires and executes the node-slot package at module load time. This injected code runs silently due to error swallowing, enabling execution of attacker-controlled code on any system that imports or requires ts-wross. The package metadata falsely claims authorship and repository information to appear legitimate. The legitimate big.js package has no dependencies and no such code, making ts-wross a lure to drop malicious code on consumers who mistakenly install it.

Any system that installs or runs the ts-wross package is considered fully compromised. The malicious code executes at import time, potentially giving attackers full control over the affected machine. All secrets and keys stored on the compromised system should be rotated immediately from a separate, trusted machine. Removing the package alone may not eliminate all malicious artifacts or backdoors introduced by the attacker.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove the ts-wross package from all affected systems. Additionally, rotate all secrets, credentials, and keys that were stored or used on the compromised machines from a secure environment. Exercise caution when installing npm packages and verify package authenticity to avoid supply chain attacks.