htps-provider @1.0.11

Summary

Package is published as htps-provider with a README copy-pasted verbatim from the legitimate Cosmos chain-registry project (advertising assets, chains, ibc exports and the same install/example snippets). The actual entrypoints do not expose that API: index.js and esm/index.mjs simply re-export HttpProvider from a runtime dependency named supersignaturenature (declared in package.json as "supersignaturenature": "^1.0.6"). esm/index.mjs performs a top-level static import of that dependency, so any ESM consumer that imports htps-provider immediately executes code from supersignaturenature. The name-and-README cover story, mismatched published API, and use of an obscurely-named third-party dependency as the sole runtime payload match the loader/stager half of a supply-chain attack, with the executable payload delivered through the transitively-installed dependency rather than this tarball. The chain.js files flagged by network/command patterns appear to be inert data/persistence modules unrelated to the loader path.

Source: amazon-inspector (4ed7eca74d8fb188a8618c67facb5015d747e423ccdf4e51caae2e4e63f82ea2)