mc-provider @1.0.10

Summary

Package metadata describes mc-provider as 'Theta chain registry ⚛️' and the README is a verbatim copy of the hyperweb-io/chain-registry README instructing consumers to import { assets, chains, ibc } from 'mc-provider' . The actual main entry does not export any of those symbols. Instead, index.js dynamically loads an unrelated runtime dependency named supersig ( providerPromise = import('supersig').then((mod) => mod.HttpProvider) ) and re-exports supersig 's HttpProvider under this package's name; esm/index.mjs does the same via import { HttpProvider } from 'supersig'; export { HttpProvider }; . Bundled chains/assets/IBC JSON files are present as decoys but are not reachable through the package's exports. Consumers following the README end up with a supersig -backed HTTP/RPC provider handling their Cosmos JSON-RPC and signing traffic — code they never chose to install, sourced from a package whose contents are outside this record. The impersonation of a well-known Cosmos registry package combined with silent resolution to an unrelated third-party provider is the standard shape used to insert attacker-controlled RPC/signing code into a wallet or dApp dependency tree.

Source: amazon-inspector (e494af2871662b1b342a26141de010623484dfef353b505805f4b41d85d775c1)