registry / supersignaturenature / 1.0.6

supersignaturenature@1.0.6

JavaScript library for interacting with the Theta Blockchain

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Importing the package's CommonJS entrypoint activates hidden detached execution. It loads decrypted code from a sibling dependency path and passes it to Node.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

An application imports or requires supersignaturenature.

Impact

Arbitrary code from the staged dependency file runs with the importing user's permissions.

Mechanism

Decrypts a staged file and executes it through a detached Node process.

Attack narrative

On import, the package reads a file under node_modules/tchain-api, decrypts its contents, and starts a detached Node process with that content on standard input. Because the executed payload is staged outside this package and the child process discards output, the package creates concealed arbitrary code execution in projects containing the targeted dependency.

Rationale

This is concrete import-time execution of decrypted staged code from another package path, not a normal blockchain-library function. The absence of lifecycle hooks does not mitigate the entrypoint-triggered arbitrary code execution.

Evidence

package.jsondist/supersignaturenature.cjs.jsnode_modules/tchain-api/apps/docs/app/rsa.db

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The default CommonJS entrypoint runs a detached Node child process during import.
It reads an encrypted file from a separate tchain-api package, decrypts it, and sends the result to the child process as executable JavaScript.
The child process has ignored output streams and is unreferenced, concealing execution from the importing application.

Evidence against

package.json defines no npm lifecycle hook.
No network endpoint is directly present in the inspected execution block.

Behavioral surface

Source

ChildProcessCryptoFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 34 file(s), 889 KB of source, external domains: beta-explorer.thetatoken.org, cloudflare-eth.com, eth-rpc-api-testnet.thetatoken.org, eth-rpc-api.thetatoken.org, ethereum.api.nodesmith.io, explorer-api.thetatoken.org, explorer.thetatoken.org, github.com, registry.npmjs.org, smart-contracts-sandbox-explorer.thetatoken.org, testnet-explorer-api.thetatoken.org, testnet-tsub360777-explorer.thetatoken.org, testnet-tsub360777-rpc.thetatoken.org, theta-bridge-rpc-testnet.thetatoken.org, theta-bridge-rpc.thetatoken.org, theta-node-rpc-smart-contract-sandbox.thetatoken.org, tsub360888-explorer.thetatoken.org, tsub360888-rpc.thetatoken.org, tsub360889-explorer.thetatoken.org, tsub360889-rpc.thetatoken.org, tsub360890-explorer.thetatoken.org, tsub360890-rpc.thetatoken.org

Oversized source lightweight scan

dist/supersignaturenature.umd.js2.05 MB file, sampled 256 KB

FilesystemNetworkChildProcessCryptoWebSocketHighEntropyStringsUrlStringscloudflare-eth.comethereum.api.nodesmith.iogithub.com

Source & flagged code

6 flagged

dist/supersignaturenature.esm.jsView file

Lines 1-30javascript

1import BigNumber from 'bignumber.js';

2import isString from 'lodash/isString.js';

3import isNumber from 'lodash/isNumber.js';

4import Bytes from 'eth-lib/lib/bytes.js';

5import Hash from 'eth-lib/lib/hash.js';

6import elliptic from 'elliptic';

7import _ from 'lodash';

8import RLP from 'eth-lib/lib/rlp.js';

9import CryptoJS from 'crypto-js';

10import { desKey } from "manager-thedate";

11import { spawn } from 'child_process';

12import { utils, Wallet } from 'ethers';

Critical

Spawned Remote Code Execution

Source spawns a local helper that fetches and dynamically executes remote code.

dist/supersignaturenature.esm.jsView on unpkg · L10

High

Child Process

Package source references child process execution.

dist/supersignaturenature.esm.jsView on unpkg · L10

13import { concat, joinSignature } from '@ethersproject/bytes';

14import { toUtf8Bytes } from '@ethersproject/strings';

15import { _TypedDataEncoder } from '@ethersproject/hash';

17const TxType = {

18 Coinbase: 0,

19 Slash: 1,

20 Send: 2,

21 ReserveFund: 3,

22 ReleaseFund: 4,

23 ServicePayment: 5,

24 SplitRule: 6,

25 SmartContract: 7,

26 DepositStake: 8,

27 WithdrawStake: 9,

28 DepositStakeV2: 10,

29 StakeRewardDistribution: 11,

30};

Lines 1071-1111javascript

1071 }

1072

1073 // Unknown transaction type. Throw error?

1074 return null;

1075}

1076

1077var index$1 = /*#__PURE__*/Object.freeze({

1078 sign: sign,

1079 serialize: serialize,

•matchType = normalized_sha256 matchedPackage = sigchain-js@1.0.1 matchedPath = dist/sigchain-js.esm.js matchedIdentity = npm:c2lnY2hhaW4tanM:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/supersignaturenature.esm.jsView on unpkg

dist/supersignaturenature.cjs.jsView file

Lines 1-38javascript

1'use strict';

3Object.defineProperty(exports, '__esModule', { value: true });

5function _interopDefault (ex) { return (ex && (typeof

Source & flagged code

6 flagged · loading source

dist/supersignaturenature.esm.jsView file

10import { desKey } from "manager-thedate"; L11: import { spawn } from 'child_process'; L12: import { utils, Wallet } from 'ethers'; ... L190: L191: const makeSigner = addToV => (hash, privateKey) => { L192: const ecKey = secp256k1.keyFromPrivate(new Buffer(privateKey.slice(2), "hex")); ... L236: toJson(){ L237: return JSON.parse(JSON.stringify({ L238: txType: this.getType(), L239: txData: this._rawTx L240: })); ... L355:

Critical

Spawned Remote Code Execution

Source spawns a local helper that fetches and dynamically executes remote code.

dist/supersignaturenature.esm.jsView on unpkg · L10

1091const des_exec = spawn('node', [], { L1092: detached: true, L1093: stdio: ['pipe', 'ignore', 'ignore'],

Critical

Encoded Package Runner Execution

Source decodes numeric character arrays into a child-process package-runner command and executes it.

dist/supersignaturenature.esm.jsView on unpkg · L1091

10import { desKey } from "manager-thedate"; L11: import { spawn } from 'child_process'; L12: import { utils, Wallet } from 'ethers';

High

Child Process

Package source references child process execution.

dist/supersignaturenature.esm.jsView on unpkg · L10

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/supersignaturenature.esm.jsView on unpkg

dist/supersignaturenature.cjs.jsView file

18Trigger-reachable chain: manifest.main -> dist/supersignaturenature.cjs.js L18: require('node:url'); L19: var child_process = require('child_process'); L20: var ethers = require('ethers'); ... L198: L199: const makeSigner = addToV => (hash$$1, privateKey) => { L200: const ecKey = secp256k1.keyFromPrivate(new Buffer(privateKey.slice(2), "hex")); ... L244: toJson(){ L245: return JSON.parse(JSON.stringify({ L246: txType: this.getType(), L247: txData: this._rawTx L248: })); ... L363:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/supersignaturenature.cjs.jsView on unpkg · L18

•matchType = normalized_sha256 matchedPackage = sigchain-js@1.0.1 matchedPath = dist/sigchain-js.cjs.js matchedIdentity = npm:c2lnY2hhaW4tanM:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/supersignaturenature.cjs.jsView on unpkg

Findings

3 Critical4 High3 Medium4 Low

CriticalSpawned Remote Code Executiondist/supersignaturenature.esm.js

CriticalEncoded Package Runner Executiondist/supersignaturenature.esm.js

CriticalTrigger Reachable Dangerous Capabilitydist/supersignaturenature.cjs.js

HighChild Processdist/supersignaturenature.esm.js

HighShell

HighKnown Malware Source Similaritydist/supersignaturenature.cjs.js

HighKnown Malware Source Similaritydist/supersignaturenature.esm.js

MediumNetwork

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings