The npm package big-tss@5.0.5 impersonates the popular big.js library but contains malicious code that silently loads and executes a third-party package named npm-doc-dev when imported. This behavior is hidden by a try/catch block that suppresses errors, and the declared dependency (npm-dc-dev) differs from the actually required package, forming a trojan-dropper pattern. This results in arbitrary code execution on the machine of anyone importing big-tss@5.0.5.