mc-registry @1.0.9

Summary

Package publishes as mc-registry with description 'Theta chain registry', but its README, badges, homepage layout, and package listing copy the legitimate hyperweb-io/chain-registry npm package. The README instructs users to npm install theta-registry and import { assets, chains, ibc } from 'theta-registry' , while the shipped name is mc-registry and the shipped API diverges from chain-registry by re-exporting HttpProvider from an unrelated third-party dependency chain-analyze ( ^1.0.4 ). The ESM entry esm/index.js performs import { HttpProvider } from 'chain-analyze'; at top level, so any consumer that does import 'mc-registry' loads and executes chain-analyze code in the installer/consumer process. chain-analyze is not part of the chain-registry ecosystem and has no relationship to the advertised 'chain registry' data purpose. The internal accessor is named loadPartnerVaultHttpProvider , further indicating the module funnels callers into an unvetted HTTP provider from the injected dependency. Files esm/mainnet/persistence/chain.js and mainnet/persistence/chain.js contain ping / POST network patterns co-located with chain persistence logic.

Source: amazon-inspector (50f3053643e65c63fa7d8e3d5c48ae3d659650bd0052137099cd8674232780bc)