registry / big-tss / 5.0.4

big-tss@5.0.4

A small, fast, easy-to-use library for arbitrary-precision decimal arithmetic

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the CommonJS entry executes an unrelated dependency and calls its API before exposing the arithmetic library. The delegated behavior is hidden by an empty catch block; no direct payload behavior is present in this package.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer require/import resolving the CommonJS entry.

Impact

The dependency may execute arbitrary install-time/runtime JavaScript in consuming environments.

Mechanism

Import-time third-party dependency bridge with suppressed failures.

Rationale

The concealed, import-time dependency invocation has no arithmetic-library purpose and creates an unresolved payload-execution path. Direct harmful behavior is not present locally, so this warrants a warning rather than a definitive block.

Evidence

package.jsonbig.jsbig.mjs

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

big.js:606 imports npm-doc-dev during module initialization.
big.js:607 invokes doc.from_str() with errors silently suppressed.
big.mjs:606-607 contains the same hidden dependency bridge.

big-tss@5.0.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code