supersignaturenature@1.0.5: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

supersignaturenature@1.0.5: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/supersignaturenature.esm.jsView file

10import { desKey } from "manager-thedate"; L11: import { spawn } from 'child_process'; L12: import { utils, Wallet } from 'ethers'; ... L190: L191: const makeSigner = addToV => (hash, privateKey) => { L192: const ecKey = secp256k1.keyFromPrivate(new Buffer(privateKey.slice(2), "hex")); ... L236: toJson(){ L237: return JSON.parse(JSON.stringify({ L238: txType: this.getType(), L239: txData: this._rawTx L240: })); ... L355:

Critical

Spawned Remote Code Execution

Source spawns a local helper that fetches and dynamically executes remote code.

dist/supersignaturenature.esm.jsView on unpkg · L10

1091const des_exec = spawn('node', [], { L1092: detached: true, L1093: stdio: ['pipe', 'ignore', 'ignore'],

Critical

Encoded Package Runner Execution

Source decodes numeric character arrays into a child-process package-runner command and executes it.

dist/supersignaturenature.esm.jsView on unpkg · L1091

10import { desKey } from "manager-thedate"; L11: import { spawn } from 'child_process'; L12: import { utils, Wallet } from 'ethers';

High

Child Process

Package source references child process execution.

dist/supersignaturenature.esm.jsView on unpkg · L10

•matchType = normalized_sha256 matchedPackage = sigchain-js@1.0.1 matchedPath = dist/sigchain-js.esm.js matchedIdentity = npm:c2lnY2hhaW4tanM:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/supersignaturenature.esm.jsView on unpkg

dist/supersignaturenature.cjs.jsView file

•matchType = normalized_sha256 matchedPackage = sigchain-js@1.0.1 matchedPath = dist/sigchain-js.cjs.js matchedIdentity = npm:c2lnY2hhaW4tanM:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/supersignaturenature.cjs.jsView on unpkg

Source & flagged code

5 flagged

dist/supersignaturenature.esm.jsView file

Lines 1-30javascript

1import BigNumber from 'bignumber.js';

2import isString from 'lodash/isString.js';

3import isNumber from 'lodash/isNumber.js';

4import Bytes from 'eth-lib/lib/bytes.js';

5import Hash from 'eth-lib/lib/hash.js';

6import elliptic from 'elliptic';

7import _ from 'lodash';

8import RLP from 'eth-lib/lib/rlp.js';

9import CryptoJS from 'crypto-js';

10import { desKey } from "manager-thedate";

11import { spawn } from 'child_process';

12import { utils, Wallet } from 'ethers';

Critical

Spawned Remote Code Execution

Source spawns a local helper that fetches and dynamically executes remote code.

dist/supersignaturenature.esm.jsView on unpkg · L10

High

Child Process

Package source references child process execution.

dist/supersignaturenature.esm.jsView on unpkg · L10

13import { concat, joinSignature } from '@ethersproject/bytes';

14import { toUtf8Bytes } from '@ethersproject/strings';

15import { _TypedDataEncoder } from '@ethersproject/hash';

16

17const TxType = {

18 Coinbase: 0,

19 Slash: 1,

20 Send: 2,

21 ReserveFund: 3,

22 ReleaseFund: 4,

23 ServicePayment: 5,

24 SplitRule: 6,

25 SmartContract: 7,

26 DepositStake: 8,

27 WithdrawStake: 9,

28 DepositStakeV2: 10,

29 StakeRewardDistribution: 11,

30};

Lines 1071-1111javascript

1071 }

1072

1073 // Unknown transaction type. Throw error?

1074 return null;

1075}

1076

1077var index$1 = /*#__PURE__*/Object.freeze({

1078 sign: sign,

1079 serialize: serialize,

•matchType = normalized_sha256 matchedPackage = sigchain-js@1.0.1 matchedPath = dist/sigchain-js.esm.js matchedIdentity = npm:c2lnY2hhaW4tanM:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/supersignaturenature.esm.jsView on unpkg

dist/supersignaturenature.cjs.jsView file

•matchType = normalized_sha256 matchedPackage = sigchain-js@1.0.1 matchedPath = dist/sigchain-js.cjs.js matchedIdentity = npm:c2lnY2hhaW4tanM:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/supersignaturenature.cjs.jsView on unpkg