registry / Remote code execution / supersignaturenature
supersignaturenature
JavaScript library for interacting with the Theta Blockchain
This report shows the evidence for supersignaturenature@1.0.6. 2 of 3 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete import-time execution of decrypted staged code from another package path, not a normal blockchain-library function. The absence of lifecycle hooks does not mitigate the entrypoint-triggered arbitrary code execution.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
An application imports or requires supersignaturenature.
Impact
Arbitrary code from the staged dependency file runs with the importing user's permissions.
Mechanism
Decrypts a staged file and executes it through a detached Node process.
Attack narrative
On import, the package reads a file under node_modules/tchain-api, decrypts its contents, and starts a detached Node process with that content on standard input. Because the executed payload is staged outside this package and the child process discards output, the package creates concealed arbitrary code execution in projects containing the targeted dependency.
AI rationale
This is concrete import-time execution of decrypted staged code from another package path, not a normal blockchain-library function. The absence of lifecycle hooks does not mitigate the entrypoint-triggered arbitrary code execution.
Evidence
package.jsondist/supersignaturenature.cjs.jsnode_modules/tchain-api/apps/docs/app/rsa.db
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The default CommonJS entrypoint runs a detached Node child process during import.
- It reads an encrypted file from a separate tchain-api package, decrypts it, and sends the result to the child process as executable JavaScript.
- The child process has ignored output streams and is unreferenced, concealing execution from the importing application.
Evidence against
- package.json defines no npm lifecycle hook.
- No network endpoint is directly present in the inspected execution block.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
WildcardDependency
Oversized source lightweight scan
dist/supersignaturenature.umd.js2.05 MB file, sampled 256 KB
FilesystemNetworkChildProcessCryptoWebSocketHighEntropyStringsUrlStringscloudflare-eth.comethereum.api.nodesmith.iogithub.com
Source & flagged code
6 flagged · loading sourcedist/supersignaturenature.esm.jsView file
10import { desKey } from "manager-thedate";
L11: import { spawn } from 'child_process';
L12: import { utils, Wallet } from 'ethers';
...
L190:
L191: const makeSigner = addToV => (hash, privateKey) => {
L192: const ecKey = secp256k1.keyFromPrivate(new Buffer(privateKey.slice(2), "hex"));
...
L236: toJson(){
L237: return JSON.parse(JSON.stringify({
L238: txType: this.getType(),
L239: txData: this._rawTx
L240: }));
...
L355:
Critical
Spawned Remote Code Execution
Source spawns a local helper that fetches and dynamically executes remote code.
dist/supersignaturenature.esm.jsView on unpkg · L101091const des_exec = spawn('node', [], {
L1092: detached: true,
L1093: stdio: ['pipe', 'ignore', 'ignore'],
Critical
Encoded Package Runner Execution
Source decodes numeric character arrays into a child-process package-runner command and executes it.
dist/supersignaturenature.esm.jsView on unpkg · L109110import { desKey } from "manager-thedate";
L11: import { spawn } from 'child_process';
L12: import { utils, Wallet } from 'ethers';
High
Child Process
Package source references child process execution.
dist/supersignaturenature.esm.jsView on unpkg · L10•matchType = normalized_sha256
matchedPackage = sigchain-js@1.0.1
matchedPath = dist/sigchain-js.esm.js
matchedIdentity = npm:c2lnY2hhaW4tanM:1.0.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/supersignaturenature.esm.jsView on unpkgdist/supersignaturenature.cjs.jsView file
18Trigger-reachable chain: manifest.main -> dist/supersignaturenature.cjs.js
L18: require('node:url');
L19: var child_process = require('child_process');
L20: var ethers = require('ethers');
...
L198:
L199: const makeSigner = addToV => (hash$$1, privateKey) => {
L200: const ecKey = secp256k1.keyFromPrivate(new Buffer(privateKey.slice(2), "hex"));
...
L244: toJson(){
L245: return JSON.parse(JSON.stringify({
L246: txType: this.getType(),
L247: txData: this._rawTx
L248: }));
...
L363:
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/supersignaturenature.cjs.jsView on unpkg · L18•matchType = normalized_sha256
matchedPackage = sigchain-js@1.0.1
matchedPath = dist/sigchain-js.cjs.js
matchedIdentity = npm:c2lnY2hhaW4tanM:1.0.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/supersignaturenature.cjs.jsView on unpkgFindings
3 Critical4 High3 Medium4 Low
CriticalSpawned Remote Code Executiondist/supersignaturenature.esm.js
CriticalEncoded Package Runner Executiondist/supersignaturenature.esm.js
CriticalTrigger Reachable Dangerous Capabilitydist/supersignaturenature.cjs.js
HighChild Processdist/supersignaturenature.esm.js
HighShell
HighKnown Malware Source Similaritydist/supersignaturenature.cjs.js
HighKnown Malware Source Similaritydist/supersignaturenature.esm.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to supersignaturenature@1.0.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing supersignaturenature@1.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.