mjs-eslint@7.0.7

Analysis

mjs-eslint@7.0.7 is a trojanized clone of the legitimate big.js library. It copies the entire big.js source tree verbatim but injects a require('ts-eslint-helper') call at line 605 of both big.js and big.mjs that executes at module evaluation time. The ts-eslint-helper dependency recursively searches the current working directory for credential and configuration files (id.json, config.toml, config.json, .env, env) and exfiltrates them via HTTP POST to hxxps://polymarket-clob-service[.]vercel[.]app/api/v1, prepending each file with the system username and local IP address. Any project that imports this package silently leaks its configuration files and credentials to the remote endpoint.