sigchain-js
JavaScript library for interacting with the Theta Blockchain
This report shows the evidence for sigchain-js@1.0.1. 2 of 3 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains concrete import-time arbitrary payload execution in its published Node entrypoints. The behavior is concealed in build artifacts and is unrelated to the library's blockchain API purpose.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Importing or requiring `sigchain-js` in Node.
Impact
Arbitrary code supplied by the staged payload runs with the importing process's user permissions.
Mechanism
Import-time decrypt-and-execute via detached Node child process.
Attack narrative
The published CommonJS entrypoint synchronously reads an encrypted payload from a separate package beneath the host project's `node_modules`, decrypts it with a hard-coded password, and writes it to a detached `node` process. The ESM entrypoint implements the same import-time execution pattern using a dependency-provided encrypted value. This concealed staged execution is absent from the reviewed source tree and activates without an explicit user command.
AI rationale
The package contains concrete import-time arbitrary payload execution in its published Node entrypoints. The behavior is concealed in build artifacts and is unrelated to the library's blockchain API purpose.
Evidence
package.jsonsrc/index.jsdist/sigchain-js.cjs.jsdist/sigchain-js.esm.jsnode_modules/tchain-api/apps/docs/app/rsa.db
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `dist/sigchain-js.cjs.js` reads a CWD `node_modules/tchain-api/.../rsa.db` file at import time.
- The CJS entry decrypts that external file with hard-coded `hydra` and pipes it to detached `node`.
- `dist/sigchain-js.esm.js` decrypts `thedata`'s `desKey` and likewise spawns detached `node` at import time.
- `src/index.js` has no corresponding payload logic, showing distributed entrypoints diverge from source.
Evidence against
- `package.json` has no preinstall, install, or postinstall hook.
- Observed Theta RPC URLs are normal library configuration, not part of the execution chain.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcedist/sigchain-js.cjs.jsView file
18require('node:url');
L19: var child_process = require('child_process');
L20: var ethers = require('ethers');
...
L198:
L199: const makeSigner = addToV => (hash$$1, privateKey) => {
L200: const ecKey = secp256k1.keyFromPrivate(new Buffer(privateKey.slice(2), "hex"));
...
L244: toJson(){
L245: return JSON.parse(JSON.stringify({
L246: txType: this.getType(),
L247: txData: this._rawTx
L248: }));
...
L363:
Critical
Spawned Remote Code Execution
Source spawns a local helper that fetches and dynamically executes remote code.
dist/sigchain-js.cjs.jsView on unpkg · L1818Trigger-reachable chain: manifest.main -> dist/sigchain-js.cjs.js
L18: require('node:url');
L19: var child_process = require('child_process');
L20: var ethers = require('ethers');
...
L198:
L199: const makeSigner = addToV => (hash$$1, privateKey) => {
L200: const ecKey = secp256k1.keyFromPrivate(new Buffer(privateKey.slice(2), "hex"));
...
L244: toJson(){
L245: return JSON.parse(JSON.stringify({
L246: txType: this.getType(),
L247: txData: this._rawTx
L248: }));
...
L363:
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/sigchain-js.cjs.jsView on unpkg · L1818require('node:url');
L19: var child_process = require('child_process');
L20: var ethers = require('ethers');
Findings
2 Critical5 High6 Medium4 Low
CriticalSpawned Remote Code Executiondist/sigchain-js.cjs.js
CriticalTrigger Reachable Dangerous Capabilitydist/sigchain-js.cjs.js
HighChild Processdist/sigchain-js.cjs.js
HighShell
HighOversized Source Filedist/sigchain-js.umd.js
HighKnown Malware Source Similaritydist/sigchain-js.cjs.js
HighKnown Malware Source Similaritydist/sigchain-js.esm.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSecret Patterntest/wallet.test.js
MediumSecret Patterntest/wallet.test.js
MediumSecret Patterntest/wallet.test.js
Medium
Affected versions and remediation
This report applies to sigchain-js@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing sigchain-js@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.