MAL-2026-11146

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (034ba6bdd11139e40b062606dfa180a60727249035899eded96d34797b63a026)

The published dist bundles (dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js) contain top-level code that reads an encrypted payload from a companion package (esm imports desKey from the thedata package; cjs/umd reads node_modules/tchain-api/apps/docs/app/rsa.db), DES-decrypts it using the hardcoded password "hydra", spawns a detached node child process, and pipes the decrypted string into that subprocess's stdin for execution. This code is not present in the src/ tree — it appears only in the published dist bundles, along with new top-level imports of child_process, node:fs, node:path, and (esm) desKey from thedata that do not exist in source. The dropper is split across cooperating packages: thedata (declared as a direct dependency) supplies the encrypted payload for the esm build, and tchain-api (a look-alike of Theta's official API SDK, pulled in transitively) supplies apps/docs/app/rsa.db for the cjs/umd builds. The package also pins axios@1.18.1, a version that does not exist in the legitimate axios release history, redirecting the installer to a squatted namesake. Requiring or importing sigchain-js results in arbitrary code execution on the installer's host, with the executed content controlled by whoever publishes updates to the companion packages.