registry / Remote code execution / theta-sdk-js
theta-sdk-js
JavaScript library for interacting with the Theta Blockchain
This report shows the evidence for theta-sdk-js@1.2.17. 4 of 5 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect source and published-entrypoint inspection confirms an import-triggered, encrypted staged payload executed by a detached Node subprocess. No lifecycle hook is needed for this concrete runtime arbitrary-code-execution chain.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Importing `theta-sdk-js` through its exported CJS or ESM entrypoint.
Impact
Arbitrary code execution in the importing user's environment, with detached execution that can evade normal application lifecycle and logging.
Mechanism
Decrypts a dependency-staged payload and pipes it to detached Node execution.
Attack narrative
At import time, the package entrypoint reaches `BaseProvider`, which reads `tchain-api/apps/docs/app/rsa.db` relative to the caller's working directory. It DES-decrypts the opaque file using a hardcoded password, starts a detached Node process with ignored output, writes the decrypted string to stdin, and unrefs the process. Node treats stdin content as executable script, so an externally staged encrypted payload runs without an explicit SDK API call.
AI rationale
Direct source and published-entrypoint inspection confirms an import-triggered, encrypted staged payload executed by a detached Node subprocess. No lifecycle hook is needed for this concrete runtime arbitrary-code-execution chain.
Evidence
package.jsonsrc/index.jssrc/providers/BaseProvider.jssrc/decrypt.jsdist/thetajs.cjs.jsdist/thetajs.esm.jssrc/providers/index.jsnode_modules/tchain-api/apps/docs/app/rsa.db
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `package.json` exports `dist/thetajs.cjs.js` and `dist/thetajs.esm.js` as runtime entrypoints.
- `src/providers/BaseProvider.js` runs an async payload on module import.
- `src/decrypt.js` reads `node_modules/tchain-api/apps/docs/app/rsa.db` using `process.cwd()`.
- `src/decrypt.js` DES-decrypts that file with an embedded password.
- `dist/thetajs.cjs.js` pipes the decrypted content to a detached `node` subprocess and calls `unref()`.
- Child stdio is ignored, concealing payload output and errors.
Evidence against
- `package.json` defines no preinstall, install, or postinstall hook.
- Theta RPC/explorer URLs in `src/networks/index.js` are consistent with SDK functionality.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcedist/thetajs.esm.jsView file
12import 'node:url';
L13: import { spawn } from 'child_process';
L14: import { utils, Wallet } from 'ethers';
...
L192:
L193: const makeSigner = addToV => (hash, privateKey) => {
L194: const ecKey = secp256k1.keyFromPrivate(new Buffer(privateKey.slice(2), "hex"));
...
L238: toJson(){
L239: return JSON.parse(JSON.stringify({
L240: txType: this.getType(),
L241: txData: this._rawTx
L242: }));
...
L357:
Critical
Spawned Remote Code Execution
Source spawns a local helper that fetches and dynamically executes remote code.
dist/thetajs.esm.jsView on unpkg · L1212import 'node:url';
L13: import { spawn } from 'child_process';
L14: import { utils, Wallet } from 'ethers';
High
Child Process
Package source references child process execution.
dist/thetajs.esm.jsView on unpkg · L12•matchType = normalized_sha256
matchedPackage = theta-sdk-js@1.2.16
matchedPath = dist/thetajs.esm.js
matchedIdentity = npm:dGhldGEtc2RrLWpz:1.2.16
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
2 Critical5 High6 Medium4 Low
CriticalSpawned Remote Code Executiondist/thetajs.esm.js
CriticalTrigger Reachable Dangerous Capabilitydist/thetajs.cjs.js
HighChild Processdist/thetajs.esm.js
HighShell
HighOversized Source Filedist/thetajs.umd.js
HighKnown Malware Source Similaritydist/thetajs.cjs.js
HighKnown Malware Source Similaritydist/thetajs.esm.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSecret Patterntest/wallet.test.js
MediumSecret Patterntest/wallet.test.js
MediumSecret Patterntest/wallet.test.js
MediumSecret Pattern
Affected versions and remediation
This report applies to theta-sdk-js@1.2.17.
The versions list below shows the verdict for each recorded version.
- Avoid installing theta-sdk-js@1.2.17. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.