st-biginteger@5.0.5

Analysis

st-biginteger is a combosquat of the legitimate big.js arbitrary-precision decimal arithmetic library. The package ships a clean copy of big.js source but declares a dependency on sjs-builders (a known-malicious package). When installed, sjs-builders' postinstall hook executes heavily obfuscated JavaScript (javascript-obfuscator style with dictionary-array decoding) that runs arbitrary payload. This is a dependency-chain supply-chain attack: the combosquat appears legitimate at first glance (same README, repo URL, and source as the real library) but silently introduces malware through its dependency tree.