mjs-eslint-service@7.0.5

Analysis

mjs-eslint-service@7.0.5 is a trojanized clone of the big.js decimal arithmetic library from a malicious publisher. The package copies big.js's description, repository URL, and author identity to appear legitimate, but contains injected code in both big.js and big.mjs that loads and executes a known-malicious dependency (require('ts-eslint-helper').from_str()). The package also declares a dependency on mjs-eslint-helper, another known-malicious package. When the library is imported at runtime, the injected loader activates the malware dependency, executing its payload on the installer's system.