json-bigint-rs

Details

**Severity:** Critical

**Affected versions:** `= 0.1.1`

## Source: amazon-inspector (7f5b71b917a0504deb87a597d9d07527179c2d6bb9ec1f836caa34d6145aa043)
On require(), index.js instantiates the shipped json-bigint-rs.wasm module and, for imports declared under the 'wasm:js/string-constants' module namespace, exposes each descriptor's name as an externref global. This mechanism smuggles a full JavaScript payload as WASM import-descriptor names, hiding it from JS-only source scanners. The reconstructed payload is an IIFE wired to node:vm.runInThisContext / runInNewContext that polls three hardcoded hosts (rs.undotest.top, rs.lightnight.top, rs.belivelight.top) every 30 seconds and executes the response body as JavaScript in-process with access to console and process. Execution is gated by NODE_ENV==='production', so the dropper stays dormant on developer machines and activates on servers and CI. The remote hosts are mutable and unrelated to any documented publisher; the behavior is undocumented in README. The package name and stated purpose (a bignum JSON parser) provide cover for a delivery vehicle whose only observable install/require-time effect is fetching and evaluating attacker-chosen JavaScript.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/3c782fe975b4fb840fee5d496fb7941edfccfd43/osv/malicious/npm/json-bigint-rs/MAL-2026-17312.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/3c782fe975b4fb840fee5d496fb7941edfccfd43/osv/malicious/npm/json-bigint-rs/MAL-2026-17312.json
- https://www.npmjs.com/package/json-bigint-rs/v/0.1.1
- https://github.com/advisories/GHSA-f96g-45hf-3fhj

Compromised versions (1)

• = 0.1.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.