registry / chain-sdk-js / 1.0.6

chain-sdk-js@1.0.6

JavaScript library for interacting with the Theta Blockchain

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Importing the package's Node CJS or ESM entrypoint triggers hidden payload handling. The published bundles diverge from the reviewed source entry and launch detached Node processes with decrypted code.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Importing or requiring `chain-sdk-js` in Node.

Impact

Arbitrary attacker-supplied code can execute in the importing user's environment.

Mechanism

decrypts hidden payload material and executes it through detached Node child processes

Attack narrative

The package entrypoints execute code on import, not through an explicit SDK feature. The CJS and UMD bundles read an encrypted payload from a separate package path, decrypt it with a hard-coded password, and send it to a detached Node process. The ESM bundle similarly decrypts two values imported from `thedata` and executes both. This behavior is absent from the source entry and build configuration, indicating injected staged payload execution.

Rationale

Published Node entrypoints contain concrete import-time staged code execution that is absent from the source tree. This is malicious behavior, independent of the package's legitimate blockchain RPC functionality.

Evidence

package.jsonsrc/index.jsrollup.config.jssrc/providers/HttpProvider.jsdist/chain-sdk-js.cjs.jsdist/chain-sdk-js.esm.jsdist/chain-sdk-js.umd.jsnode_modules/tchain-api/apps/docs/app/rsa.db

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`dist/chain-sdk-js.cjs.js` reads an encrypted `rsa.db` from `node_modules/tchain-api` during import.
`dist/chain-sdk-js.cjs.js` DES-decrypts that data and pipes it to detached `node`.
`dist/chain-sdk-js.esm.js` imports encrypted keys from `thedata` and executes two detached Node payloads at module load.
`dist/chain-sdk-js.umd.js` contains the same import-time file-read/decrypt/spawn sequence.
`src/index.js` and `rollup.config.js` contain no corresponding crypto, filesystem, or child-process code.
`package.json` exposes the affected CJS/ESM bundles as package entrypoints.

Evidence against

`package.json` has no npm lifecycle hooks.
`src/providers/HttpProvider.js` network requests are normal user-invoked blockchain RPC calls.
No AI-agent configuration mutation is present.

Behavioral surface

Source

ChildProcessCryptoFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 34 file(s), 889 KB of source, external domains: beta-explorer.thetatoken.org, cloudflare-eth.com, eth-rpc-api-testnet.thetatoken.org, eth-rpc-api.thetatoken.org, ethereum.api.nodesmith.io, explorer-api.thetatoken.org, explorer.thetatoken.org, github.com, registry.npmjs.org, smart-contracts-sandbox-explorer.thetatoken.org, testnet-explorer-api.thetatoken.org, testnet-tsub360777-explorer.thetatoken.org, testnet-tsub360777-rpc.thetatoken.org, theta-bridge-rpc-testnet.thetatoken.org, theta-bridge-rpc.thetatoken.org, theta-node-rpc-smart-contract-sandbox.thetatoken.org, tsub360888-explorer.thetatoken.org, tsub360888-rpc.thetatoken.org, tsub360889-explorer.thetatoken.org, tsub360889-rpc.thetatoken.org, tsub360890-explorer.thetatoken.org, tsub360890-rpc.thetatoken.org

Oversized source lightweight scan

dist/chain-sdk-js.umd.js2.05 MB file, sampled 256 KB

FilesystemNetworkChildProcessCryptoWebSocketHighEntropyStringsUrlStringscloudflare-eth.comethereum.api.nodesmith.iogithub.com

Source & flagged code

9 flagged

dist/chain-sdk-js.cjs.jsView file

Lines 1-38javascript

1'use strict';

3Object.defineProperty(exports, '__esModule', { value: true });

5function _interopDefault (ex) { return (ex && (typeof ex === 'object') && 'default' in ex) ? ex['default'] : ex; }

7var BigNumber = _interopDefault(require('bignumber.js'));

8var isString = _interopDefault(require('lodash/isString.js'));

9var isNumber = _interopDefault(require('lodash/isNumber.js'));

10var Bytes = _interopDefault(require('eth-lib/lib/bytes.js'));

11var Hash = _interopDefault(require('eth-lib/lib/hash.js'));

12var elliptic = _interopDefault(require('elliptic'));

13var _ = _interopDefault(require('lodash'));

14var RLP = _interopDefault(require('eth-lib/lib/rlp.js'));

15var CryptoJS = _interopDefault(require('crypto-js'));

16var node_fs = require('node:fs');

17var node_path = require('node:path');

18require('node:url');

19var child_process = require('child_process');

20var ethers = require('ethers');

Critical

Spawned Remote Code Execution

Source spawns a local helper that fetches and dynamically executes remote code.

dist/chain-sdk-js.cjs.jsView on unpkg · L18

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chain-sdk-js.cjs.jsView on unpkg · L18

High

Child Process

Package source references child process execution.

dist/chain-sdk-js.cjs.jsView on unpkg · L18

21var bytes = require('@ethersproject/bytes');

22var strings = require('@ethersproject/strings');

23var hash = require('@ethersproject/hash');

25const TxType = {

26 Coinbase: 0,

27 Slash: 1,

28 Send: 2,

29 ReserveFund: 3,

30 ReleaseFund: 4,

31 ServicePayment: 5,

32 SplitRule: 6,

33 SmartContract: 7,

34 DepositStake: 8,

35 WithdrawStake: 9,

36 DepositStakeV2: 10,

37 StakeRewardDistribution: 11,

38};

•matchType = normalized_sha256 matchedPackage = chain-sdk-js@1.0.5 matchedPath = dist/chain-sdk-js.cjs.js matchedIdentity = npm:Y2hhaW4tc2RrLWpz:1.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chain-sdk-js.cjs.jsView on unpkg

dist/chain-sdk-js.umd.jsView file

•path = dist/chain-sdk-js.umd.js kind = oversized_source_file sizeBytes = 2148819 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chain-sdk-js.umd.jsView on unpkg

test/wallet.test.jsView file

Lines 31-100javascript

31test('should create a Wallet from mnemonic index 1', () => {

32 const expectedWalletAddress = "0x471E2Aa03dbDc153a92b89Fb10B67020b729BD98";

33 const mnemonic = "remain sorry remember trick purse also roast kidney history dragon fatigue chuckle";

34 const wallet = Wallet.fromMnemonic(mnemonic, null, {

35 path: `${thetajs.constants.DerivationPaths.Theta}1`

36 });

38 expect(wallet.address).toBe(expectedWalletAddress);

39});

41test('should create a Wallet from private key', () => {

42 const expectedWalletAddress = "0x95944D0F9C86794284ABc375616C83B0E6A1A8B7";

43 const privateKey = "0x19f66b5f75f0cf6fe4fbbcca24aba2031031affef8b596b922b9dfd669f8f5ae";

44 const wallet = new Wallet(privateKey);

46 expect(wallet.address).toBe(expectedWalletAddress);

47});

49test('should encrypt a Wallet to json with password qwertyuiop', async () => {

50 const privateKey = "0x19f66b5f75f0cf6fe4fbbcca24aba2031031affef8b596b922b9dfd669f8f5ae";

51 const password = "qwertyuiop";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L51

52 const wallet = new Wallet(privateKey);

53 const json = await wallet.encryptToJson(password);

55 expect(json).not.toBe(null);

56});

58test('should encrypt then decrypt a Wallet to json with password qwertyuiop', async () => {

59 const privateKey = "0x19f66b5f75f0cf6fe4fbbcca24aba2031031affef8b596b922b9dfd669f8f5ae";

60 const password = "qwertyuiop";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L60

61 const wallet = new Wallet(privateKey);

62 const json = await wallet.encryptToJson(password);

63 const decryptedWallet = Wallet.fromEncryptedJson(json, password);

65 expect(decryptedWallet.getAddress()).toBe(wallet.getAddress());

66});

68test('should decrypt a Wallet with password qwertyuiop', async () => {

69 const expectedWalletAddress = "0x95944D0F9C86794284ABc375616C83B0E6A1A8B7";

70 const json = "{\"version\":3,\"id\":\"65da41e2-4c0a-487a-b2a4-2e5785786917\",\"address\":\"95944d0f9c86794284abc375616c83b0e6a1a8b7\",\"crypto\":{\"ciphertext\":\"f50a7176a4b6fb2dd402a3cedb9a9b7660566e9f2d6c4a800c7f20fb061aecb2\",\"cipherparams\":{\"iv\":\"75f7c49fabc77fbc78177e86cc7c2ff2\"},\"cipher\":\"aes-128-ctr\",\"kdf\":\"scrypt\",\"kdfparams\":{\"dklen\":32,\"salt\":\"68798f658e6adeeb2de05aaeaa9699c10281f9837966824f4d34a4b53bb4a7d3\",\"n\":8192,\"r\":8,\"p\":1},\"mac\":\"d46c1baa5228a8f31343f16bcccdb70adabbbd2b8577605c56e14dbc093f212c\"}}"

71 const password = "qwertyuiop";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L71

72 const decryptedWallet = Wallet.fromEncryptedJson(json, password);

74 expect(decryptedWallet.address).toBe(expectedWalletAddress);

75});

77test('should decrypt a Wallet with password qwertyuiop with a provider', async () => {

78 const expectedWalletAddress = "0x95944D0F9C86794284ABc375616C83B0E6A1A8B7";

79 const json = "{\"version\":3,\"id\":\"65da41e2-4c0a-487a-b2a4-2e5785786917\",\"address\":\"95944d0f9c86794284abc375616c83b0e6a1a8b7\",\"crypto\":{\"ciphertext\":\"f50a7176a4b6fb2dd402a3cedb9a9b7660566e9f2d6c4a800c7f20fb061aecb2\",\"cipherparams\":{\"iv\":\"75f7c49fabc77fbc78177e86cc7c2ff2\"},\"cipher\":\"aes-128-ctr\",\"kdf\":\"scrypt\",\"kdfparams\":{\"dklen\":32,\"salt\":\"68798f658e6adeeb2de05aaeaa9699c10281f9837966824f4d34a4b53bb4a7d3\",\"n\":8192,\"r\":8,\"p\":1},\"mac\":\"d46c1baa5228a8f31343f16bcccdb70adabbbd2b8577605c56e14dbc093f212c\"}}"

80 const password = "qwertyuiop";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L80

81 const provider = new HttpProvider(ChainIds.Mainnet);

82 const decryptedWallet = Wallet.fromEncryptedJson(json, password, provider);

84 expect(decryptedWallet.address).toBe(expectedWalletAddress);

85 expect(decryptedWallet.provider).not.toBe(null);

86});

88test('should sign message "hello world"', () => {

89 const expectedSignature = "0xddd0a7290af9526056b4e35a077b9a11b513aa0028ec6c9880948544508f3c63265e99e47ad31bb2cab9646c504576b3abc6939a1710afc08cbf3034d73214b81c";

90 const privateKey = "0x0123456789012345678901234567890123456789012345678901234567890123";

91 const wallet = new Wallet(privateKey);

92 const signature = wallet.signMessage('hello world');

94 expect(signature).toBe(expectedSignature);

95});

97test('should sign typed date', () => {

98 const expectedSignature = "0x4355c47d63924e8a72e509b65029052eb6c299d53a04e167c5775fd466751c9d07299936d304c153f6443dfa05f40ff007d72911b6f72307f996231605b915621c";

99 const privateKey = "0xc85ef7d79691fe79573b1a7064c19c1a9819ebdbd1faaab1a8ec92344438aaf4";

100 const wallet = new Wallet(privateKey);

Source & flagged code

9 flagged · loading source

dist/chain-sdk-js.cjs.jsView file

18require('node:url'); L19: var child_process = require('child_process'); L20: var ethers = require('ethers'); ... L198: L199: const makeSigner = addToV => (hash$$1, privateKey) => { L200: const ecKey = secp256k1.keyFromPrivate(new Buffer(privateKey.slice(2), "hex")); ... L244: toJson(){ L245: return JSON.parse(JSON.stringify({ L246: txType: this.getType(), L247: txData: this._rawTx L248: })); ... L363:

Critical

Spawned Remote Code Execution

Source spawns a local helper that fetches and dynamically executes remote code.

dist/chain-sdk-js.cjs.jsView on unpkg · L18

18Trigger-reachable chain: manifest.main -> dist/chain-sdk-js.cjs.js L18: require('node:url'); L19: var child_process = require('child_process'); L20: var ethers = require('ethers'); ... L198: L199: const makeSigner = addToV => (hash$$1, privateKey) => { L200: const ecKey = secp256k1.keyFromPrivate(new Buffer(privateKey.slice(2), "hex")); ... L244: toJson(){ L245: return JSON.parse(JSON.stringify({ L246: txType: this.getType(), L247: txData: this._rawTx L248: })); ... L363:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chain-sdk-js.cjs.jsView on unpkg · L18

18require('node:url'); L19: var child_process = require('child_process'); L20: var ethers = require('ethers');

High

Child Process

Package source references child process execution.

dist/chain-sdk-js.cjs.jsView on unpkg · L18

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chain-sdk-js.cjs.jsView on unpkg

dist/chain-sdk-js.umd.jsView file

•path = dist/chain-sdk-js.umd.js kind = oversized_source_file sizeBytes = 2148819 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chain-sdk-js.umd.jsView on unpkg

test/wallet.test.jsView file

51patternName = generic_password severity = medium line = 51 matchedText = const pa...op";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L51

60patternName = generic_password severity = medium line = 60 matchedText = const pa...op";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L60

71patternName = generic_password severity = medium line = 71 matchedText = const pa...op";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L71

80patternName = generic_password severity = medium line = 80 matchedText = const pa...op";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L80

Findings

2 Critical4 High6 Medium4 Low

CriticalSpawned Remote Code Executiondist/chain-sdk-js.cjs.js

CriticalTrigger Reachable Dangerous Capabilitydist/chain-sdk-js.cjs.js

HighChild Processdist/chain-sdk-js.cjs.js

HighShell

HighOversized Source Filedist/chain-sdk-js.umd.js

HighKnown Malware Source Similaritydist/chain-sdk-js.cjs.js

MediumNetwork

MediumStructural Risk Force Deep Review

MediumSecret Patterntest/wallet.test.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

dist/chain-sdk-js.cjs.jsView file

Lines 1-38javascript

1'use strict';

3Object.defineProperty(exports, '__esModule', { value: true });

5function _interopDefault (ex) { return (ex && (typeof ex === 'object') && 'default' in ex) ? ex['default'] : ex; }

7var BigNumber = _interopDefault(require('bignumber.js'));

8var isString = _interopDefault(require('lodash/isString.js'));

9var isNumber = _interopDefault(require('lodash/isNumber.js'));

10var Bytes = _interopDefault(require('eth-lib/lib/bytes.js'));

11var Hash = _interopDefault(require('eth-lib/lib/hash.js'));

12var elliptic = _interopDefault(require('elliptic'));

13var _ = _interopDefault(require('lodash'));

14var RLP = _interopDefault(require('eth-lib/lib/rlp.js'));

15var CryptoJS = _interopDefault(require('crypto-js'));

16var node_fs = require('node:fs');

17var node_path = require('node:path');

18require('node:url');

19var child_process = require('child_process');

20var ethers = require('ethers');

Critical

Spawned Remote Code Execution

Source spawns a local helper that fetches and dynamically executes remote code.

dist/chain-sdk-js.cjs.jsView on unpkg · L18

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chain-sdk-js.cjs.jsView on unpkg · L18

High

Child Process

Package source references child process execution.

dist/chain-sdk-js.cjs.jsView on unpkg · L18

21var bytes = require('@ethersproject/bytes');

22var strings = require('@ethersproject/strings');

23var hash = require('@ethersproject/hash');

25const TxType = {

26 Coinbase: 0,

27 Slash: 1,

28 Send: 2,

29 ReserveFund: 3,

30 ReleaseFund: 4,

31 ServicePayment: 5,

32 SplitRule: 6,

33 SmartContract: 7,

34 DepositStake: 8,

35 WithdrawStake: 9,

36 DepositStakeV2: 10,

37 StakeRewardDistribution: 11,

38};

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chain-sdk-js.cjs.jsView on unpkg

dist/chain-sdk-js.umd.jsView file

•path = dist/chain-sdk-js.umd.js kind = oversized_source_file sizeBytes = 2148819 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chain-sdk-js.umd.jsView on unpkg

test/wallet.test.jsView file

Lines 31-100javascript

31test('should create a Wallet from mnemonic index 1', () => {

32 const expectedWalletAddress = "0x471E2Aa03dbDc153a92b89Fb10B67020b729BD98";

33 const mnemonic = "remain sorry remember trick purse also roast kidney history dragon fatigue chuckle";

34 const wallet = Wallet.fromMnemonic(mnemonic, null, {

35 path: `${thetajs.constants.DerivationPaths.Theta}1`

36 });

38 expect(wallet.address).toBe(expectedWalletAddress);

39});

41test('should create a Wallet from private key', () => {

42 const expectedWalletAddress = "0x95944D0F9C86794284ABc375616C83B0E6A1A8B7";

43 const privateKey = "0x19f66b5f75f0cf6fe4fbbcca24aba2031031affef8b596b922b9dfd669f8f5ae";

44 const wallet = new Wallet(privateKey);

46 expect(wallet.address).toBe(expectedWalletAddress);

47});

49test('should encrypt a Wallet to json with password qwertyuiop', async () => {

50 const privateKey = "0x19f66b5f75f0cf6fe4fbbcca24aba2031031affef8b596b922b9dfd669f8f5ae";

51 const password = "qwertyuiop";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L51

52 const wallet = new Wallet(privateKey);

53 const json = await wallet.encryptToJson(password);

55 expect(json).not.toBe(null);

56});

58test('should encrypt then decrypt a Wallet to json with password qwertyuiop', async () => {

59 const privateKey = "0x19f66b5f75f0cf6fe4fbbcca24aba2031031affef8b596b922b9dfd669f8f5ae";

60 const password = "qwertyuiop";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L60

61 const wallet = new Wallet(privateKey);

62 const json = await wallet.encryptToJson(password);

63 const decryptedWallet = Wallet.fromEncryptedJson(json, password);

65 expect(decryptedWallet.getAddress()).toBe(wallet.getAddress());

66});

68test('should decrypt a Wallet with password qwertyuiop', async () => {

69 const expectedWalletAddress = "0x95944D0F9C86794284ABc375616C83B0E6A1A8B7";

71 const password = "qwertyuiop";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L71

72 const decryptedWallet = Wallet.fromEncryptedJson(json, password);

74 expect(decryptedWallet.address).toBe(expectedWalletAddress);

75});

77test('should decrypt a Wallet with password qwertyuiop with a provider', async () => {

78 const expectedWalletAddress = "0x95944D0F9C86794284ABc375616C83B0E6A1A8B7";

80 const password = "qwertyuiop";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L80

81 const provider = new HttpProvider(ChainIds.Mainnet);

82 const decryptedWallet = Wallet.fromEncryptedJson(json, password, provider);

84 expect(decryptedWallet.address).toBe(expectedWalletAddress);

85 expect(decryptedWallet.provider).not.toBe(null);

86});

88test('should sign message "hello world"', () => {

89 const expectedSignature = "0xddd0a7290af9526056b4e35a077b9a11b513aa0028ec6c9880948544508f3c63265e99e47ad31bb2cab9646c504576b3abc6939a1710afc08cbf3034d73214b81c";

90 const privateKey = "0x0123456789012345678901234567890123456789012345678901234567890123";

91 const wallet = new Wallet(privateKey);

92 const signature = wallet.signMessage('hello world');

94 expect(signature).toBe(expectedSignature);

95});

97test('should sign typed date', () => {

98 const expectedSignature = "0x4355c47d63924e8a72e509b65029052eb6c299d53a04e167c5775fd466751c9d07299936d304c153f6443dfa05f40ff007d72911b6f72307f996231605b915621c";

99 const privateKey = "0xc85ef7d79691fe79573b1a7064c19c1a9819ebdbd1faaab1a8ec92344438aaf4";

100 const wallet = new Wallet(privateKey);