MAL-2026-14305

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e494af2871662b1b342a26141de010623484dfef353b505805f4b41d85d775c1) Package metadata describes `mc-provider` as 'Theta chain registry ⚛️' and the README is a verbatim copy of the hyperweb-io/chain-registry README instructing consumers to `import { assets, chains, ibc } from 'mc-provider'`. The actual main entry does not export any of those symbols. Instead, `index.js` dynamically loads an unrelated runtime dependency named `supersig` (`providerPromise = import('supersig').then((mod) => mod.HttpProvider)`) and re-exports `supersig`'s `HttpProvider` under this package's name; `esm/index.mjs` does the same via `import { HttpProvider } from 'supersig'; export { HttpProvider };`. Bundled chains/assets/IBC JSON files are present as decoys but are not reachable through the package's exports. Consumers following the README end up with a `supersig`-backed HTTP/RPC provider handling their Cosmos JSON-RPC and signing traffic — code they never chose to install, sourced from a package whose contents are outside this record. The impersonation of a well-known Cosmos registry package combined with silent resolution to an unrelated third-party provider is the standard shape used to insert attacker-controlled RPC/signing code into a wallet or dApp dependency tree.