registry / theta-sdk-js / 1.2.14

theta-sdk-js@1.2.14

JavaScript library for interacting with the Theta Blockchain

AI Security Review

scanned 2h ago · by lpm-firewall-ai

A direct import of the shipped source provider triggers hidden payload loading. It reads encrypted files from a dependency and executes their decrypted contents in detached Node processes.

Static reason

One or more suspicious static signals were detected.

Trigger

Import `src/providers/BaseProvider.js` directly, including through the source provider export.

Impact

Arbitrary code from opaque dependency files can execute without caller consent and with hidden output.

Mechanism

Dependency payload decryption followed by detached Node execution via stdin.

Attack narrative

The shipped source provider imports decrypted strings that are derived from opaque files in `tchain-api`. At module load it feeds each string to a detached `node` child process, unrefs it, and discards all output. This is a concealed execution chain rather than SDK functionality; it lets dependency-controlled content run when that source module is imported.

Rationale

The source contains a concrete hidden arbitrary-code execution chain. Although normal package entrypoints use bundles without this loader and there is no install hook, the packaged source remains directly importable and malicious.

Evidence

package.jsonsrc/providers/BaseProvider.jssrc/decrypt.jssrc/providers/index.jsdist/thetajs.cjs.jsdist/thetajs.esm.jsdist/thetajs.umd.jsdist/thetajs.browser.jsnode_modules/tchain-api/apps/docs/app/rsa.dbnode_modules/tchain-api/apps/docs/app/des.db

Decision evidence

public snapshot

AI called this Malicious at 93.0% confidence as Malware with low false-positive risk.

Evidence for block

`src/providers/BaseProvider.js` runs two import-time async IIFEs.
It decrypts values imported from `src/decrypt.js` then starts detached `node` processes.
Each process receives decrypted content over stdin, is unreferenced, and suppresses stdout/stderr.
`src/decrypt.js` reads `node_modules/tchain-api/apps/docs/app/{rsa,des}.db` and decrypts them with hard-coded `hydra`.

Evidence against

`package.json` has no preinstall/install/postinstall lifecycle hook.
Published entrypoints point to `dist/*`; inspected bundles do not contain the decrypt/spawn loader.
The visible RPC endpoints are Theta blockchain service URLs.

Behavioral surface

Source

ChildProcessCryptoFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 36 file(s), 2.57 MB of source, external domains: api-goerli.etherscan.io, api-kovan.etherscan.io, api-rinkeby.etherscan.io, api-ropsten.etherscan.io, api.etherscan.io, beta-explorer.thetatoken.org, cloudflare-eth.com, ecma-international.org, eev.ee, en.wikipedia.org, eth-rpc-api-testnet.thetatoken.org, eth-rpc-api.thetatoken.org, ethereum.api.nodesmith.io, explorer-api.thetatoken.org, explorer.thetatoken.org, github.com, mathiasbynens.be, npms.io, registry.npmjs.org, smart-contracts-sandbox-explorer.thetatoken.org, testnet-explorer-api.thetatoken.org, testnet-tsub360777-explorer.thetatoken.org, testnet-tsub360777-rpc.thetatoken.org, theta-bridge-rpc-testnet.thetatoken.org, theta-bridge-rpc.thetatoken.org, theta-node-rpc-smart-contract-sandbox.thetatoken.org, tsub360888-explorer.thetatoken.org, tsub360888-rpc.thetatoken.org, tsub360889-explorer.thetatoken.org, tsub360889-rpc.thetatoken.org, tsub360890-explorer.thetatoken.org, tsub360890-rpc.thetatoken.org, www.ethercluster.com

Source & flagged code

5 flagged

dist/thetajs.umd.jsView file

42651patternName = generic_password severity = medium line = 42651 matchedText = logger.t... });

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/thetajs.umd.jsView on unpkg · L42651

test/wallet.test.jsView file

Lines 31-100javascript

31test('should create a Wallet from mnemonic index 1', () => {

32 const expectedWalletAddress = "0x471E2Aa03dbDc153a92b89Fb10B67020b729BD98";

33 const mnemonic = "remain sorry remember trick purse also roast kidney history dragon fatigue chuckle";

34 const wallet = Wallet.fromMnemonic(mnemonic, null, {

35 path: `${thetajs.constants.DerivationPaths.Theta}1`

36 });

38 expect(wallet.address).toBe(expectedWalletAddress);

39});

41test('should create a Wallet from private key', () => {

42 const expectedWalletAddress = "0x95944D0F9C86794284ABc375616C83B0E6A1A8B7";

43 const privateKey = "0x19f66b5f75f0cf6fe4fbbcca24aba2031031affef8b596b922b9dfd669f8f5ae";

44 const wallet = new Wallet(privateKey);

46 expect(wallet.address).toBe(expectedWalletAddress);

47});

49test('should encrypt a Wallet to json with password qwertyuiop', async () => {

50 const privateKey = "0x19f66b5f75f0cf6fe4fbbcca24aba2031031affef8b596b922b9dfd669f8f5ae";

51 const password = "qwertyuiop";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L51

52 const wallet = new Wallet(privateKey);

53 const json = await wallet.encryptToJson(password);

55 expect(json).not.toBe(null);

56});

58test('should encrypt then decrypt a Wallet to json with password qwertyuiop', async () => {

59 const privateKey = "0x19f66b5f75f0cf6fe4fbbcca24aba2031031affef8b596b922b9dfd669f8f5ae";

60 const password = "qwertyuiop";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L60

61 const wallet = new Wallet(privateKey);

62 const json = await wallet.encryptToJson(password);

63 const decryptedWallet = Wallet.fromEncryptedJson(json, password);

65 expect(decryptedWallet.getAddress()).toBe(wallet.getAddress());

66});

68test('should decrypt a Wallet with password qwertyuiop', async () => {

69 const expectedWalletAddress = "0x95944D0F9C86794284ABc375616C83B0E6A1A8B7";

70 const json = "{\"version\":3,\"id\":\"65da41e2-4c0a-487a-b2a4-2e5785786917\",\"address\":\"95944d0f9c86794284abc375616c83b0e6a1a8b7\",\"crypto\":{\"ciphertext\":\"f50a7176a4b6fb2dd402a3cedb9a9b7660566e9f2d6c4a800c7f20fb061aecb2\",\"cipherparams\":{\"iv\":\"

71 const password = "qwertyuiop";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L71

72 const decryptedWallet = Wallet.fromEncryptedJson(json, password);

74 expect(decryptedWallet.address).toBe(expectedWalletAddress);

75});

77test('should decrypt a Wallet with password qwertyuiop with a provider', async () => {

78 const expectedWalletAddress = "0x95944D0F9C86794284ABc375616C83B0E6A1A8B7";

79 const json = "{\"version\":3,\"id\":\"65da41e2-4c0a-487a-b2a4-2e5785786917\",\"address\":\"95944d0f9c86794284abc375616c83b0e6a1a8b7\",\"crypto\":{\"ciphertext\":\"f50a7176a4b6fb2dd402a3cedb9a9b7660566e9f2d6c4a800c7f20fb061aecb2\",\"cipherparams\":{\"iv\":\"

80 const password = "qwertyuiop";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L80

81 const provider = new HttpProvider(ChainIds.Mainnet);

82 const decryptedWallet = Wallet.fromEncryptedJson(json, password, provider);

84 expect(decryptedWallet.address).toBe(expectedWalletAddress);

85 expect(decryptedWallet.provider).not.toBe(null);

86});

88test('should sign message "hello world"', () => {

89 const expectedSignature = "0xddd0a7290af9526056b4e35a077b9a11b513aa0028ec6c9880948544508f3c63265e99e47ad31bb2cab9646c504576b3abc6939a1710afc08cbf3034d73214b81c";

90 const privateKey = "0x0123456789012345678901234567890123456789012345678901234567890123";

91 const wallet = new Wallet(privateKey);

92 const signature = wallet.signMessage('hello world');

94 expect(signature).toBe(expectedSignature);

95});

97test('should sign typed date', () => {

98 const expectedSignature = "0x4355c47d63924e8a72e509b65029052eb6c299d53a04e167c5775fd466751c9d07299936d304c153f6443dfa05f40ff007d72911b6f72307f996231605b915621c";

99 const privateKey = "0xc85ef7d79691fe79573b1a7064c19c1a9819ebdbd1faaab1a8ec92344438aaf4";

100 const wallet = new Wallet(privateKey);

Source & flagged code

5 flagged · loading source

dist/thetajs.umd.jsView file

42651patternName = generic_password severity = medium line = 42651 matchedText = logger.t... });

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/thetajs.umd.jsView on unpkg · L42651

test/wallet.test.jsView file

51patternName = generic_password severity = medium line = 51 matchedText = const pa...op";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L51

60patternName = generic_password severity = medium line = 60 matchedText = const pa...op";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L60

71patternName = generic_password severity = medium line = 71 matchedText = const pa...op";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L71

80patternName = generic_password severity = medium line = 80 matchedText = const pa...op";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L80

Findings

6 Medium4 Low

MediumSecret Patterndist/thetajs.umd.js

MediumNetwork

MediumSecret Patterntest/wallet.test.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/thetajs.umd.jsView file

42651patternName = generic_password severity = medium line = 42651 matchedText = logger.t... });

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/thetajs.umd.jsView on unpkg · L42651

test/wallet.test.jsView file

Lines 31-100javascript

31test('should create a Wallet from mnemonic index 1', () => {

32 const expectedWalletAddress = "0x471E2Aa03dbDc153a92b89Fb10B67020b729BD98";

33 const mnemonic = "remain sorry remember trick purse also roast kidney history dragon fatigue chuckle";

34 const wallet = Wallet.fromMnemonic(mnemonic, null, {

35 path: `${thetajs.constants.DerivationPaths.Theta}1`

36 });

38 expect(wallet.address).toBe(expectedWalletAddress);

39});

41test('should create a Wallet from private key', () => {

42 const expectedWalletAddress = "0x95944D0F9C86794284ABc375616C83B0E6A1A8B7";

43 const privateKey = "0x19f66b5f75f0cf6fe4fbbcca24aba2031031affef8b596b922b9dfd669f8f5ae";

44 const wallet = new Wallet(privateKey);

46 expect(wallet.address).toBe(expectedWalletAddress);

47});

49test('should encrypt a Wallet to json with password qwertyuiop', async () => {

50 const privateKey = "0x19f66b5f75f0cf6fe4fbbcca24aba2031031affef8b596b922b9dfd669f8f5ae";

51 const password = "qwertyuiop";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L51

52 const wallet = new Wallet(privateKey);

53 const json = await wallet.encryptToJson(password);

55 expect(json).not.toBe(null);

56});

58test('should encrypt then decrypt a Wallet to json with password qwertyuiop', async () => {

59 const privateKey = "0x19f66b5f75f0cf6fe4fbbcca24aba2031031affef8b596b922b9dfd669f8f5ae";

60 const password = "qwertyuiop";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L60

61 const wallet = new Wallet(privateKey);

62 const json = await wallet.encryptToJson(password);

63 const decryptedWallet = Wallet.fromEncryptedJson(json, password);

65 expect(decryptedWallet.getAddress()).toBe(wallet.getAddress());

66});

68test('should decrypt a Wallet with password qwertyuiop', async () => {

69 const expectedWalletAddress = "0x95944D0F9C86794284ABc375616C83B0E6A1A8B7";

71 const password = "qwertyuiop";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L71

72 const decryptedWallet = Wallet.fromEncryptedJson(json, password);

74 expect(decryptedWallet.address).toBe(expectedWalletAddress);

75});

77test('should decrypt a Wallet with password qwertyuiop with a provider', async () => {

78 const expectedWalletAddress = "0x95944D0F9C86794284ABc375616C83B0E6A1A8B7";

80 const password = "qwertyuiop";

Medium

Secret Pattern

Hardcoded password in test/wallet.test.js

test/wallet.test.jsView on unpkg · L80

81 const provider = new HttpProvider(ChainIds.Mainnet);

82 const decryptedWallet = Wallet.fromEncryptedJson(json, password, provider);

84 expect(decryptedWallet.address).toBe(expectedWalletAddress);

85 expect(decryptedWallet.provider).not.toBe(null);

86});

88test('should sign message "hello world"', () => {

89 const expectedSignature = "0xddd0a7290af9526056b4e35a077b9a11b513aa0028ec6c9880948544508f3c63265e99e47ad31bb2cab9646c504576b3abc6939a1710afc08cbf3034d73214b81c";

90 const privateKey = "0x0123456789012345678901234567890123456789012345678901234567890123";

91 const wallet = new Wallet(privateKey);

92 const signature = wallet.signMessage('hello world');

94 expect(signature).toBe(expectedSignature);

95});

97test('should sign typed date', () => {

98 const expectedSignature = "0x4355c47d63924e8a72e509b65029052eb6c299d53a04e167c5775fd466751c9d07299936d304c153f6443dfa05f40ff007d72911b6f72307f996231605b915621c";

99 const privateKey = "0xc85ef7d79691fe79573b1a7064c19c1a9819ebdbd1faaab1a8ec92344438aaf4";

100 const wallet = new Wallet(privateKey);