sigchain-js

{"schema_version":"1.7.4","id":"MAL-2026-11146","published":"2026-07-28T13:36:13Z","modified":"2026-08-20T18:27:56.961611485Z","aliases":["GHSA-xq2c-h4ch-xmwj"],"summary":"Malicious code in sigchain-js (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (034ba6bdd11139e40b062606dfa180a60727249035899eded96d34797b63a026)\nThe published dist bundles (dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js) contain top-level code that reads an encrypted payload from a companion package (esm imports `desKey` from the `thedata` package; cjs/umd reads `node_modules/tchain-api/apps/docs/app/rsa.db`), DES-decrypts it using the hardcoded password \"hydra\", spawns a detached `node` child process, and pipes the decrypted string into that subprocess's stdin for execution. This code is not present in the src/ tree — it appears only in the published dist bundles, along with new top-level imports of `child_process`, `node:fs`, `node:path`, and (esm) `desKey` from `thedata` that do not exist in source. The dropper is split across cooperating packages: `thedata` (declared as a direct dependency) supplies the encrypted payload for the esm build, and `tchain-api` (a look-alike of Theta's official API SDK, pulled in transitively) supplies `apps/docs/app/rsa.db` for the cjs/umd builds. The package also pins `axios@1.18.1`, a version that does not exist in the legitimate axios release history, redirecting the installer to a squatted namesake. Requiring or importing sigchain-js results in arbitrary code execution on the installer's host, with the executed content controlled by whoever publishes updates to the companion packages.\n\n## Source: ghsa-malware (104d25d6fa2b72141154551a4a50ea8c6a496d4fc1ce6fd212207d4fe321ee4b)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"sigchain-js","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/sigchain-js.cjs.js","sha256":"35cfc3d9c44c0b56ad6e6c42e988a074b6f1ff24ad54cbb0d6556d28a69a99fd","tlsh":"f363939d26e7a060815b70b56fdb94407129e00b68ccd82cbdac53958fd946c9bf2ff8"},{"path":"dist/sigchain-js.esm.js","sha256":"b7235eeffd783b1eb05b6a699794148a7990a8345b860bb50776a3aeb09d8e5c","tlsh":"6163949d26e7a060815b70b56fdb94407129e00b68ccd82cbdac53958fd946c9bf2ff8"},{"path":"package.json","sha256":"a0e4b135cdcc437031ffec05b47a80aadde1ade6ce25c23313d2e884902417e1","tlsh":"e431f1b0cd65cdb315c805a92839514730289487c807f89c33960b4d4f4e26f72f6bbd"}],"package_integrity":[{"filename":"sigchain-js-1.0.1.tgz","hashes":{"sha1":"6a1d8c138a8370c60d5a10e2946ca170c1ea20df","sha512_sri":"sha512-1xFMo/2RvwPNOgc1PI9/w4GIyCrPAnSmoqaJCiyfWJHyYtXmyJdbLsesDLDjTFKHQLpcpKKx7FSvSBeQpHXbQQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sigchain-js/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sigchain-js/v/1.0.0"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-xq2c-h4ch-xmwj"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010918","import_time":"2026-07-28T14:19:59.058435965Z","modified_time":"2026-07-28T13:36:13Z","sha256":"034ba6bdd11139e40b062606dfa180a60727249035899eded96d34797b63a026","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-015795","import_time":"2026-08-05T16:13:45.946548928Z","modified_time":"2026-08-05T15:41:30Z","sha256":"00aeb447293557590fe41c30b3d687a94555dfa6547b28697a578e1b432d929d","source":"amazon-inspector","versions":["1.0.0"]},{"id":"GHSA-xq2c-h4ch-xmwj","import_time":"2026-08-20T18:26:05.035324812Z","modified_time":"2026-08-20T18:15:34Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"104d25d6fa2b72141154551a4a50ea8c6a496d4fc1ce6fd212207d4fe321ee4b","source":"ghsa-malware"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}