{"answers":{"affected":"1 open source package ship an affected version, including sigchain-js.","exploited":"There is no known exploitation of MAL-2026-11146 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-11146 is a malicious package in sigchain-js, published on 28 Jul 2026."},"fix_prompt":"MAL-2026-11146 is a malicious package: sigchain-js (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-11146/ (Markdown: https://insights.sbomify.com/MAL-2026-11146/index.md)","id":"MAL-2026-11146","markdown":"https://insights.sbomify.com/MAL-2026-11146/index.md","name":"MAL-2026-11146","record":{"aliases":["GHSA-xq2c-h4ch-xmwj"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The published dist bundles (dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js) contain top-level code that reads an encrypted payload from a companion package (esm imports `desKey` from the `thedata` package; cjs/umd reads `node_modules/tchain-api/apps/docs/app/rsa.db`), DES-decrypts it using the hardcoded password \"hydra\", spawns a detached `node` child process, and pipes the decrypted string into that subprocess's stdin for execution. This code is not present in the src/ tree — it appears only in the published dist bundles, along with new top-level imports of `child_process`, `node:fs`, `node:path`, and (esm) `desKey` from `thedata` that do not exist in source. The dropper is split across cooperating packages: `thedata` (declared as a direct dependency) supplies the encrypted payload for the esm build, and `tchain-api` (a look-alike of Theta's official API SDK, pulled in transitively) supplies `apps/docs/app/rsa.db` for the cjs/umd builds. The package also pins `axios@1.18.1`, a version that does not exist in the legitimate axios release history, redirecting the installer to a squatted namesake. Requiring or importing sigchain-js results in arbitrary code execution on the installer's host, with the executed content controlled by whoever publishes updates to the companion packages.\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in sigchain-js (npm)","id":"MAL-2026-11146","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"sigchain-js","purl":"pkg:npm/sigchain-js","source":"MAL-2026-11146"}],"products":null,"published":"2026-07-28","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-11146/"}