MAL-2026-12396 Malicious code in log-min (npm)

The package publishes as 'log-min' with a description claiming it is a JavaScript library for the Theta Blockchain, while its README identifies the project as 'chain-sdk-js' — an impersonation of the Theta chain-sdk-js SDK. package.json declares postinstall 'node src', which loads src/providers/BaseProvider.js. That module's top-level IIFE imports an opaque blob 'desKey' from the 'thedata' npm dependency, DES-decrypts it with the hardcoded password 'hydra', spawns a detached 'node' child process with piped stdin and ignored stdio, writes the decrypted code into the child's stdin, and unrefs the child so it survives the installer. The identical decrypt-and-exec pattern is also present at the top level of the shipped CJS bundle dist/log-min.cjs.js, so the dropper fires both at 'npm install' via the postinstall hook and whenever any consumer require()s the package. The executed bytes originate in a separate dependency ('thedata') and are not present in the log-min tarball, giving the author of that dependency arbitrary code execution on any machine that installs or imports log-min.