st-bigintr@5.0.5

Analysis

Combosquat of the big.js arbitrary-precision decimal arithmetic library. The package name st-bigintr impersonates the legitimate big.js on npm. It ships an otherwise unmodified copy of big.js but injects a try/catch block at the end of big.js and big.mjs that loads and executes a known-malicious dependency (sjs-builder) via require() at runtime. The malicious code runs when the library is imported — no install hook needed. The package manifest falsely claims the original big.js author, repository, and GitHub URL to appear legitimate.