registry / Remote code execution / chain-sdk-js
chain-sdk-js
JavaScript library for interacting with the Theta Blockchain
This report shows the evidence for chain-sdk-js@1.0.6. 5 of 6 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiPublished Node entrypoints contain concrete import-time staged code execution that is absent from the source tree. This is malicious behavior, independent of the package's legitimate blockchain RPC functionality.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Importing or requiring `chain-sdk-js` in Node.
Impact
Arbitrary attacker-supplied code can execute in the importing user's environment.
Mechanism
decrypts hidden payload material and executes it through detached Node child processes
Attack narrative
The package entrypoints execute code on import, not through an explicit SDK feature. The CJS and UMD bundles read an encrypted payload from a separate package path, decrypt it with a hard-coded password, and send it to a detached Node process. The ESM bundle similarly decrypts two values imported from `thedata` and executes both. This behavior is absent from the source entry and build configuration, indicating injected staged payload execution.
AI rationale
Published Node entrypoints contain concrete import-time staged code execution that is absent from the source tree. This is malicious behavior, independent of the package's legitimate blockchain RPC functionality.
Evidence
package.jsonsrc/index.jsrollup.config.jssrc/providers/HttpProvider.jsdist/chain-sdk-js.cjs.jsdist/chain-sdk-js.esm.jsdist/chain-sdk-js.umd.jsnode_modules/tchain-api/apps/docs/app/rsa.db
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `dist/chain-sdk-js.cjs.js` reads an encrypted `rsa.db` from `node_modules/tchain-api` during import.
- `dist/chain-sdk-js.cjs.js` DES-decrypts that data and pipes it to detached `node`.
- `dist/chain-sdk-js.esm.js` imports encrypted keys from `thedata` and executes two detached Node payloads at module load.
- `dist/chain-sdk-js.umd.js` contains the same import-time file-read/decrypt/spawn sequence.
- `src/index.js` and `rollup.config.js` contain no corresponding crypto, filesystem, or child-process code.
- `package.json` exposes the affected CJS/ESM bundles as package entrypoints.
Evidence against
- `package.json` has no npm lifecycle hooks.
- `src/providers/HttpProvider.js` network requests are normal user-invoked blockchain RPC calls.
- No AI-agent configuration mutation is present.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
9 flagged · loading sourcedist/chain-sdk-js.cjs.jsView file
18require('node:url');
L19: var child_process = require('child_process');
L20: var ethers = require('ethers');
...
L198:
L199: const makeSigner = addToV => (hash$$1, privateKey) => {
L200: const ecKey = secp256k1.keyFromPrivate(new Buffer(privateKey.slice(2), "hex"));
...
L244: toJson(){
L245: return JSON.parse(JSON.stringify({
L246: txType: this.getType(),
L247: txData: this._rawTx
L248: }));
...
L363:
Critical
Spawned Remote Code Execution
Source spawns a local helper that fetches and dynamically executes remote code.
dist/chain-sdk-js.cjs.jsView on unpkg · L1818Trigger-reachable chain: manifest.main -> dist/chain-sdk-js.cjs.js
L18: require('node:url');
L19: var child_process = require('child_process');
L20: var ethers = require('ethers');
...
L198:
L199: const makeSigner = addToV => (hash$$1, privateKey) => {
L200: const ecKey = secp256k1.keyFromPrivate(new Buffer(privateKey.slice(2), "hex"));
...
L244: toJson(){
L245: return JSON.parse(JSON.stringify({
L246: txType: this.getType(),
L247: txData: this._rawTx
L248: }));
...
L363:
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/chain-sdk-js.cjs.jsView on unpkg · L1818require('node:url');
L19: var child_process = require('child_process');
L20: var ethers = require('ethers');
Findings
2 Critical4 High6 Medium4 Low
CriticalSpawned Remote Code Executiondist/chain-sdk-js.cjs.js
CriticalTrigger Reachable Dangerous Capabilitydist/chain-sdk-js.cjs.js
HighChild Processdist/chain-sdk-js.cjs.js
HighShell
HighOversized Source Filedist/chain-sdk-js.umd.js
HighKnown Malware Source Similaritydist/chain-sdk-js.cjs.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSecret Patterntest/wallet.test.js
MediumSecret Patterntest/wallet.test.js
MediumSecret Patterntest/wallet.test.js
MediumSecret Patterntest/wallet.test.js
LowScripts Present
Affected versions and remediation
This report applies to chain-sdk-js@1.0.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing chain-sdk-js@1.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.