unbig.js@6.2.12

Analysis

unbig.js is a combosquat of the legitimate arbitrary-precision arithmetic library big.js: it ships that library's source near-verbatim (the file headers still read "big.js v6.2.1") and copies big.js's description, keywords, author, homepage and repository URL (github[.]com/MikeMcl/big.js) while publishing under the unrelated name unbig.js, so an installer pulling "unbig.js" believes they are getting big.js. An installation has no reason to resolve to this package. The shipped package.json also contains a non-upstream "config" block that is absent from big.js: eleven base64 blobs under "config.tags" and one ~170-character base64 blob under "config.cmds". The blobs are high-entropy and do not decode to readable JavaScript, and no code in the package reads them, so they are inert as published. The bundled big.js/big.mjs code itself is unmodified library arithmetic: there is no network access, no process execution, no dynamic code generation, no environment or credential access, and no lifecycle hook, so no C2 host, IP or callback URL can be attributed to this package.