registry / sigchain-js / 1.0.1

sigchain-js@1.0.1

JavaScript library for interacting with the Theta Blockchain

AI Security Review

scanned 8h ago · by lpm-firewall-ai

Importing either Node entrypoint activates a hidden payload. The CJS build targets a foreign dependency file; the ESM build executes decrypted content supplied by `thedata`.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime import of the package through its ESM or CommonJS entrypoint.

Impact

Arbitrary local code execution in the importing application's environment; the CJS path also reads a file from another installed package.

Mechanism

Top-level decryption and detached Node execution of hidden payload code.

Attack narrative

On import, the ESM artifact decrypts `thedata`'s `desKey` and sends the plaintext to a detached Node process. Separately, the CJS artifact reads an encrypted `rsa.db` from the unrelated `tchain-api` package, decrypts it with a hard-coded password, and executes the result through detached Node. These behaviors are absent from the package source and build configuration, so the distributed entrypoint artifacts contain an injected arbitrary-code execution chain.

Rationale

Confirmed top-level detached-process execution of decrypted hidden content is concrete arbitrary code execution, not a package-aligned blockchain capability. The mismatch between source and published entry artifacts strengthens the conclusion of malicious tampering.

Evidence

package.jsonrollup.config.jssrc/index.jsdist/sigchain-js.esm.jsdist/sigchain-js.cjs.jsnode_modules/tchain-api/apps/docs/app/rsa.db

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`dist/sigchain-js.esm.js` imports `desKey` from `thedata`, decrypts it, and runs it with detached `node`.
`dist/sigchain-js.cjs.js` reads `node_modules/tchain-api/apps/docs/app/rsa.db`, decrypts it with hard-coded `hydra`, then pipes it to detached `node`.
Both payloads run in top-level async IIFEs during module initialization; no user API call is required.
`src/` and `rollup.config.js` contain neither the payload logic nor its imports, indicating malicious compiled-artifact injection.

Evidence against

`package.json` defines no install, preinstall, or postinstall lifecycle hook.
No concrete network endpoint is present in the confirmed injected execution chain.

Behavioral surface

Source

ChildProcessCryptoFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 34 file(s), 889 KB of source, external domains: beta-explorer.thetatoken.org, cloudflare-eth.com, eth-rpc-api-testnet.thetatoken.org, eth-rpc-api.thetatoken.org, ethereum.api.nodesmith.io, explorer-api.thetatoken.org, explorer.thetatoken.org, github.com, registry.npmjs.org, smart-contracts-sandbox-explorer.thetatoken.org, testnet-explorer-api.thetatoken.org, testnet-tsub360777-explorer.thetatoken.org, testnet-tsub360777-rpc.thetatoken.org, theta-bridge-rpc-testnet.thetatoken.org, theta-bridge-rpc.thetatoken.org, theta-node-rpc-smart-contract-sandbox.thetatoken.org, tsub360888-explorer.thetatoken.org, tsub360888-rpc.thetatoken.org, tsub360889-explorer.thetatoken.org, tsub360889-rpc.thetatoken.org, tsub360890-explorer.thetatoken.org, tsub360890-rpc.thetatoken.org

Oversized source lightweight scan

dist/sigchain-js.umd.js2.05 MB file, sampled 256 KB

FilesystemNetworkChildProcessCryptoWebSocketHighEntropyStringsUrlStringscloudflare-eth.comethereum.api.nodesmith.iogithub.com

Source & flagged code

10 flagged

dist/sigchain-js.cjs.jsView file

Lines 1-38javascript

1'use strict';

3Object.defineProperty(exports, '__esModule', { value: true });

5function _interopDefault (ex) { return (ex && (typeof ex === 'object') && 'default' in ex) ? ex['default'] : ex; }

7var BigNumber = _interopDefault(require('bignumber.js'));

8var isString = _interopDefault(require('lodash/isString.js'));

9var isNumber = _interopDefault(require('lodash/isNumber.js'));

10var Bytes = _interopDefault(require('eth-lib/lib/bytes.js'));

11var Hash = _interopDefault(require('eth-lib/lib/hash.js'));

12var elliptic = _interopDefault(require('elliptic'));

13var _ = _interopDefault(require('lodash'));

14var RLP = _interopDefault(require('eth-lib/lib/rlp.js'));

15var CryptoJS = _interopDefault(require('crypto-js'));

16var node_fs = require('node:fs');

17var node_path = require('node:path');

18require('node:url');

19var child_process = require('child_process');

20var ethers = require('ethers');

Critical

Spawned Remote Code Execution

Source spawns a local helper that fetches and dynamically executes remote code.

dist/sigchain-js.cjs.jsView on unpkg · L18

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/sigchain-js.cjs.jsView on unpkg · L18

High

Child Process

Package source references child process execution.

dist/sigchain-js.cjs.jsView on unpkg · L18

21var bytes = require('@ethersproject/bytes');

22var strings = require('@ethersproject/strings');

23var hash = require('@ethersproject/hash');

25const TxType = {

26 Coinbase: 0,

27 Slash: 1,

28 Send: 2,

29 ReserveFund: 3,

30 ReleaseFund: 4,

31 ServicePayment: 5,

32 SplitRule: 6,

33 SmartContract: 7,

34 DepositStake: 8,

35 WithdrawStake: 9,

36 DepositStakeV2: 10,

37 StakeRewardDistribution: 11,

38};

•matchType = normalized_sha256 matchedPackage = sigchain-js@1.0.0 matchedPath = dist/sigchain-js.cjs.js matchedIdentity = npm:c2lnY2hhaW4tanM:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/sigchain-js.cjs.jsView on unpkg

dist/sigchain-js.umd.jsView file

•path = dist/sigchain-js.umd.js kind = oversized_source_file sizeBytes = 2148819 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/sigchain-js.umd.jsView on unpkg

dist/sigchain-js.esm.jsView file

•matchType = token_shingles matchedPackage = sigchain-js@1.0.0 matchedPath = dist/sigchain-js.esm.js matchedIdentity = npm:c2lnY2hhaW4tanM:1.0.0 similarity = 0.708 shingleOverlap = 34 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/sigchain-js.esm.jsView on unpkg

test/wallet.test.jsView file

Lines 31-100javascript

31test('should create a Wallet from mnemonic index 1', () => {

32 const expectedWalletAddress = "0x471E2Aa03dbDc153a92b89Fb10B67020b729BD98";

33 const mnemonic = "remain sorry remember trick purse also roast kidney history dragon fatigue chuckle";

Source & flagged code

10 flagged · loading source

dist/sigchain-js.cjs.jsView file

18require('node:url'); L19: var child_process = require('child_process'); L20: var ethers = require('ethers'); ... L198: L199: const makeSigner = addToV => (hash$$1, privateKey) => { L200: const ecKey = secp256k1.keyFromPrivate(new Buffer(privateKey.slice(2), "hex")); ... L244: toJson(){ L245: return JSON.parse(JSON.stringify({ L246: txType: this.getType(), L247: txData: this._rawTx L248: })); ... L363:

Critical

Spawned Remote Code Execution

Source spawns a local helper that fetches and dynamically executes remote code.

dist/sigchain-js.cjs.jsView on unpkg · L18

18Trigger-reachable chain: manifest.main -> dist/sigchain-js.cjs.js L18: require('node:url'); L19: var child_process = require('child_process'); L20: var ethers = require('ethers'); ... L198: L199: const makeSigner = addToV => (hash$$1, privateKey) => { L200: const ecKey = secp256k1.keyFromPrivate(new Buffer(privateKey.slice(2), "hex")); ... L244: toJson(){ L245: return JSON.parse(JSON.stringify({ L246: txType: this.getType(), L247: txData: this._rawTx L248: })); ... L363:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/sigchain-js.cjs.jsView on unpkg · L18

18require('node:url'); L19: var child_process = require('child_process'); L20: var ethers = require('ethers');

High

Child Process

Package source references child process execution.

dist/sigchain-js.cjs.jsView on unpkg · L18

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/sigchain-js.cjs.jsView on unpkg

dist/sigchain-js.umd.jsView file

•path = dist/sigchain-js.umd.js kind = oversized_source_file sizeBytes = 2148819 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/sigchain-js.umd.jsView on unpkg

dist/sigchain-js.esm.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/sigchain-js.esm.jsView on unpkg

test/wallet.test.jsView file

51patternName = generic_password severity = medium line = 51 matchedText = const pa...op";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L51

60patternName = generic_password severity = medium line = 60 matchedText = const pa...op";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L60

71patternName = generic_password severity = medium line = 71 matchedText = const pa...op";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L71

80patternName = generic_password severity = medium line = 80 matchedText = const pa...op";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L80

Findings

2 Critical5 High6 Medium4 Low

CriticalSpawned Remote Code Executiondist/sigchain-js.cjs.js

CriticalTrigger Reachable Dangerous Capabilitydist/sigchain-js.cjs.js

HighChild Processdist/sigchain-js.cjs.js

HighShell

HighOversized Source Filedist/sigchain-js.umd.js

HighKnown Malware Source Similaritydist/sigchain-js.cjs.js

HighKnown Malware Source Similaritydist/sigchain-js.esm.js

MediumNetwork

MediumStructural Risk Force Deep Review

MediumSecret Patterntest/wallet.test.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

10 flagged

dist/sigchain-js.cjs.jsView file

Lines 1-38javascript

1'use strict';

3Object.defineProperty(exports, '__esModule', { value: true });

5function _interopDefault (ex) { return (ex && (typeof ex === 'object') && 'default' in ex) ? ex['default'] : ex; }

7var BigNumber = _interopDefault(require('bignumber.js'));

8var isString = _interopDefault(require('lodash/isString.js'));

9var isNumber = _interopDefault(require('lodash/isNumber.js'));

10var Bytes = _interopDefault(require('eth-lib/lib/bytes.js'));

11var Hash = _interopDefault(require('eth-lib/lib/hash.js'));

12var elliptic = _interopDefault(require('elliptic'));

13var _ = _interopDefault(require('lodash'));

14var RLP = _interopDefault(require('eth-lib/lib/rlp.js'));

15var CryptoJS = _interopDefault(require('crypto-js'));

16var node_fs = require('node:fs');

17var node_path = require('node:path');

18require('node:url');

19var child_process = require('child_process');

20var ethers = require('ethers');

Critical

Spawned Remote Code Execution

Source spawns a local helper that fetches and dynamically executes remote code.

dist/sigchain-js.cjs.jsView on unpkg · L18

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/sigchain-js.cjs.jsView on unpkg · L18

High

Child Process

Package source references child process execution.

dist/sigchain-js.cjs.jsView on unpkg · L18

21var bytes = require('@ethersproject/bytes');

22var strings = require('@ethersproject/strings');

23var hash = require('@ethersproject/hash');

25const TxType = {

26 Coinbase: 0,

27 Slash: 1,

28 Send: 2,

29 ReserveFund: 3,

30 ReleaseFund: 4,

31 ServicePayment: 5,

32 SplitRule: 6,

33 SmartContract: 7,

34 DepositStake: 8,

35 WithdrawStake: 9,

36 DepositStakeV2: 10,

37 StakeRewardDistribution: 11,

38};

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/sigchain-js.cjs.jsView on unpkg

dist/sigchain-js.umd.jsView file

•path = dist/sigchain-js.umd.js kind = oversized_source_file sizeBytes = 2148819 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/sigchain-js.umd.jsView on unpkg

dist/sigchain-js.esm.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/sigchain-js.esm.jsView on unpkg

test/wallet.test.jsView file

Lines 31-100javascript

31test('should create a Wallet from mnemonic index 1', () => {

32 const expectedWalletAddress = "0x471E2Aa03dbDc153a92b89Fb10B67020b729BD98";

33 const mnemonic = "remain sorry remember trick purse also roast kidney history dragon fatigue chuckle";