The ts-wross npm package is a malicious package impersonating the legitimate big.js library. It contains injected code that loads and executes a dependency called node-slot at import time, which can run attacker-controlled code silently. Installing this package can lead to full compromise of the affected system, requiring immediate secret and key rotation and removal of the package.