discovered
bjs-biginteger is identified in the SafeDep analysis "big.js Typosquat Campaign Implants SSH Backdoors". Three waves of big.js typosquats (sjs-biginteger, bjs-biginteger, cjs-biginteger) from throwaway npm accounts implant SSH backdoors and exfiltrate credentials to Cloudflare-disguised C2 infrastructure.