unbig.js@6.2.13

Analysis

`unbig.js` is a combosquat of the widely used `big.js` library: its name is the real `big.js` with an `un` prefix added, and its `package.json` still carries the upstream project's author email ([account]), `github[.]com/MikeMcl/big.js` repository/bugs URLs and opencollective funding link, while being published under a different account. The shipped JavaScript (`big.js`, `big.mjs`) is a verbatim clone of upstream big.js 6.2.1 with no lifecycle scripts, no bin entries and no network, process-execution or environment access — the code itself is clean. The payload is instead hidden in the manifest: an injected `config` block containing 14 base64 blobs under `config.tags` and one 128-character base64 blob under `config.cmds`, for example the `cmds` value `zPKEHjYV3HWi30hBCovzECnvnxDJedzD6N5x6H/zUl6yayKoq55dg2pSUvDehdGaaHAWqyrVJLNrTJDpkry3pvblhxKmAQ7bLicxqjWCsl2VqAUqWU4tRYHvzCwQDYdb` and tag entries such as `gGOQNDZqAiKnGXuXMHYCQB7Uu/KJV/pydDJUSLJewhI=` (several tag entries share the identical 16-byte tail `Tat92qTJb5hF0OTu0CoVk=`, consistent with a shared key or IV). No file in the tarball references these values, so they are inert as distributed: the package is a staging container for encoded content, not a self-executing installer in this version. No network IOCs are present in the package.