MAL-2026-11146 Malicious code in sigchain-js (npm)

The published dist bundles (dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js) contain top-level code that reads an encrypted payload from a companion package (esm imports desKey from the thedata package; cjs/umd reads node_modules/tchain-api/apps/docs/app/rsa.db), DES-decrypts it using the hardcoded password "hydra", spawns a detached node child process, and pipes the decrypted string into that subprocess's stdin for execution. This code is not present in the src/ tree — it appears only in the published dist bundles, along with new top-level imports of child_process, node:fs, node:path, and (esm) desKey from thedata that do not exist in source. The dropper is split across cooperating packages: thedata (declared as a direct dependency) supplies the encrypted payload for the esm build, and tchain-api (a look-alike of Theta's official API SDK, pulled in transitively) supplies apps/docs/app/rsa.db for the cjs/umd builds. The package also pins [email protected], a version that does not exist in the legitimate axios release history, redirecting the installer to a squatted namesake. Requiring or importing sigchain-js results in arbitrary code execution on the installer's host, with the executed content controlled by whoever publishes updates to the companion packages.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.