sigchain-js @1.0.1

Summary

The published dist bundles (dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js) contain top-level code that reads an encrypted payload from a companion package (esm imports desKey from the thedata package; cjs/umd reads node_modules/tchain-api/apps/docs/app/rsa.db ), DES-decrypts it using the hardcoded password "hydra", spawns a detached node child process, and pipes the decrypted string into that subprocess's stdin for execution. This code is not present in the src/ tree — it appears only in the published dist bundles, along with new top-level imports of child_process , node:fs , node:path , and (esm) desKey from thedata that do not exist in source. The dropper is split across cooperating packages: thedata (declared as a direct dependency) supplies the encrypted payload for the esm build, and tchain-api (a look-alike of Theta's official API SDK, pulled in transitively) supplies apps/docs/app/rsa.db for the cjs/umd builds. The package also pins axios@1.18.1 , a version that does not exist in the legitimate axios release history, redirecting the installer to a squatted namesake. Requiring or importing sigchain-js results in arbitrary code execution on the installer's host, with the executed content controlled by whoever publishes updates to the companion packages.

Source: amazon-inspector (034ba6bdd11139e40b062606dfa180a60727249035899eded96d34797b63a026)