OpenSSF/OSV advisory MAL-2026-14294 confirms this npm version as malicious. Package publishes as `mc-registry` with description 'Theta chain registry', but its README, badges, homepage layout, and package listing copy the legitimate hyperweb-io/chain-registry npm package...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in mc-registry (npm)
Details
Package publishes as `mc-registry` with description 'Theta chain registry', but its README, badges, homepage layout, and package listing copy the legitimate hyperweb-io/chain-registry npm package. The README instructs users to `npm install theta-registry` and `import { assets, chains, ibc } from 'theta-registry'`, while the shipped name is `mc-registry` and the shipped API diverges from chain-registry by re-exporting `HttpProvider` from an unrelated third-party dependency `chain-analyze` (`^1.0.4`). The ESM entry `esm/index.js` performs `import { HttpProvider } from 'chain-analyze';` at top level, so any consumer that does `import 'mc-registry'` loads and executes `chain-analyze` code in the installer/consumer process. `chain-analyze` is not part of the chain-registry ecosystem and has no relationship to the advertised 'chain registry' data purpose. The internal accessor is named `loadPartnerVaultHttpProvider`, further indicating the module funnels callers into an unvetted HTTP provider from the injected dependency. Files `esm/mainnet/persistence/chain.js` and `mainnet/persistence/chain.js` contain `ping`/`POST` network patterns co-located with chain persistence logic.
Decision reason
OpenSSF Malicious Packages via OSV confirms mc-registry@1.0.8 as malicious (MAL-2026-14294): Malicious code in mc-registry (npm)