GCVE-110-OSM-2026-9556

This package declares 'lint-builds' as a dependency, which is confirmed malicious by both internal signatures and the OSM database. The package itself ('big-decimal-ts') is a typosquat/impersonation of the legitimate 'big.js' library by Michael Mclaughlin — the entrypoint contains what appears to be legitimate big.js v7.0.1 source code, indicating the attacker is using a supply chain injection model: bundle a real, trusted library with a malicious dependency to reduce suspicion. The malicious dependency 'lint-builds' is the actual attack vector; it would be pulled in transitively when a developer installs big-decimal-ts. The IOCs and entrypoint code are benign, but the dependency-based attack is a well-known pattern (e.g., Contagious Interview / DPRK campaign tooling) where the payload is delivered via a nested malicious package rather than the top-level package's own source. ENTRY big.mjs (main: big.mjs) ADDITIONAL FINDINGS - Malicious Dependency Detected in package.json - Malicious Dependency Detected (OSM) in package.json