MAL-2026-14294

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (50f3053643e65c63fa7d8e3d5c48ae3d659650bd0052137099cd8674232780bc) Package publishes as `mc-registry` with description 'Theta chain registry', but its README, badges, homepage layout, and package listing copy the legitimate hyperweb-io/chain-registry npm package. The README instructs users to `npm install theta-registry` and `import { assets, chains, ibc } from 'theta-registry'`, while the shipped name is `mc-registry` and the shipped API diverges from chain-registry by re-exporting `HttpProvider` from an unrelated third-party dependency `chain-analyze` (`^1.0.4`). The ESM entry `esm/index.js` performs `import { HttpProvider } from 'chain-analyze';` at top level, so any consumer that does `import 'mc-registry'` loads and executes `chain-analyze` code in the installer/consumer process. `chain-analyze` is not part of the chain-registry ecosystem and has no relationship to the advertised 'chain registry' data purpose. The internal accessor is named `loadPartnerVaultHttpProvider`, further indicating the module funnels callers into an unvetted HTTP provider from the injected dependency. Files `esm/mainnet/persistence/chain.js` and `mainnet/persistence/chain.js` contain `ping`/`POST` network patterns co-located with chain persistence logic.