MAL-2026-11146

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (034ba6bdd11139e40b062606dfa180a60727249035899eded96d34797b63a026) The published dist bundles (dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js) contain top-level code that reads an encrypted payload from a companion package (esm imports `desKey` from the `thedata` package; cjs/umd reads `node_modules/tchain-api/apps/docs/app/rsa.db`), DES-decrypts it using the hardcoded password "hydra", spawns a detached `node` child process, and pipes the decrypted string into that subprocess's stdin for execution. This code is not present in the src/ tree — it appears only in the published dist bundles, along with new top-level imports of `child_process`, `node:fs`, `node:path`, and (esm) `desKey` from `thedata` that do not exist in source. The dropper is split across cooperating packages: `thedata` (declared as a direct dependency) supplies the encrypted payload for the esm build, and `tchain-api` (a look-alike of Theta's official API SDK, pulled in transitively) supplies `apps/docs/app/rsa.db` for the cjs/umd builds. The package also pins `axios@1.18.1`, a version that does not exist in the legitimate axios release history, redirecting the installer to a squatted namesake. Requiring or importing sigchain-js results in arbitrary code execution on the installer's host, with the executed content controlled by whoever publishes updates to the companion packages.