ts-escro@0.0.6

Analysis

ts-escro@0.0.6 is a trojanized clone of the legitimate big.js library. The package ships the full big.js v7.0.1 source code from a different publisher under a different name, with injected malicious code. In both big.js and big.mjs (line 606), the package silently loads an external module "parket-slot" via `require("parket-slot")` and calls `doc.from_str()` on it, with errors swallowed in an empty catch block. This means importing or requiring ts-escro triggers execution of code from the parket-slot package at runtime. Additionally, the package.json declares a non-registry dependency `"log-taker": "file:../log-taker"` which could resolve to attacker-controlled code. The package falsely attributes authorship to the real big.js maintainer Michael Mclaughlin. The README is an exact copy of the big.js README and still instructs users to install "big.js" from npm, not ts-escro.