ts-numbering@1.0.0

Analysis

ts-numbering@1.0.0 is a trojanized clone of the legitimate big.js arbitrary-precision decimal arithmetic library. The attacker copied big.js v7.0.1 verbatim and injected a malicious block into both big.js and big.mjs at line 605-609: a try/catch that requires the package 'parket-helper' and calls its from_str() method (returning a promise, suggesting string-decoded payload execution). This injected code runs in module scope whenever a project imports the package — no install hook needed. The package also declares a dependency on the known-malware package 'local-ip-helper'. Both helper packages form a multi-package supply-chain attack chain delivering an executable payload at runtime.