ts-predict-helper@3.7.0

Analysis

ts-predict-helper@3.7.0 is a trojanized clone of the legitimate big.js library. The package copies big.js source code verbatim, masquerades under Mike McLaughlin's name and repo URL, but injects a hidden require("parket-flow") call into both big.js and big.mjs that loads a known-malicious dependency automatically when the module is imported. The parket-flow package is published by the same attacker and executes upon require(). The attack is triggered simply by importing the package — no lifecycle hooks needed.