MAL-2026-11133

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chain-analyze/MAL-2026-11133.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11133
Aliases
  • GHSA-vmj5-cm6w-jrgj
Published
2026-07-28T13:26:59Z
Modified
2026-08-04T23:04:54Z
Summary
Malicious code in chain-analyze (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d)

The published tarball's dist bundles (dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js) execute at module load: they read an encrypted blob from the sibling dependency 'chain-manager' (either imported as desKey or read from a file under node_modules/chain-manager via fs.readFileSync), DES-decrypt it with a hardcoded PASSWORD, then invoke child_process.spawn('node', [], { detached: true,... }) and pipe the decrypted script into the child's stdin — running attacker-controlled Node.js code on the installer's machine on any require()/import of the package. The dropper code is present only in dist/; the src/ tree contains no reference to 'chain-manager' or to spawn('node'), and package.json's declared main 'dist/chain-analyze.cjs.js' is not shipped — only the tampered dist/sigchain-js.* bundles are, so consumers resolve to the malicious build while source reviewers see a clean Theta blockchain SDK. package.json declares author 'Theta Labs' and describes itself as a JavaScript library for the Theta blockchain, impersonating the official @thetalabs/theta-js SDK, and pins 'chain-manager' ^1.0.9 which supplies the encrypted payload — a split-package design that hides the executable code from scanners inspecting only this tarball.

Source: ghsa-malware (c36bbf5095bf780a61e33774d81ded0ffe9f5cfd2288bae3433a657fe7213c7b)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010861",
            "import_time": "2026-07-28T14:19:56.227900723Z",
            "modified_time": "2026-07-28T13:26:59Z",
            "sha256": "eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d",
            "source": "amazon-inspector",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "id": "GHSA-vmj5-cm6w-jrgj",
            "import_time": "2026-07-30T03:51:56.536262Z",
            "modified_time": "2026-07-29T05:25:40Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "sha256": "c36bbf5095bf780a61e33774d81ded0ffe9f5cfd2288bae3433a657fe7213c7b",
            "source": "ghsa-malware"
        },
        {
            "id": "IN-MAL-2026-011176",
            "import_time": "2026-08-04T22:30:03.392389446Z",
            "modified_time": "2026-08-04T21:43:31Z",
            "sha256": "d8877cec821f97e66f17477777865ad7bcd8dc42b4ec63b8ee030cee92143523",
            "source": "amazon-inspector",
            "versions": [
                "1.0.4"
            ]
        },
        {
            "id": "IN-MAL-2026-011145",
            "import_time": "2026-08-04T22:30:01.674468228Z",
            "modified_time": "2026-08-04T21:38:56Z",
            "sha256": "f0b6258e57a7241edeaf87d9b10864c66a741814e5efa9c976697478a0b0b426",
            "source": "amazon-inspector",
            "versions": [
                "1.0.3"
            ]
        },
        {
            "id": "IN-MAL-2026-011135",
            "import_time": "2026-08-04T22:30:01.018632549Z",
            "modified_time": "2026-08-04T21:37:32Z",
            "sha256": "81a44b7aa447611f16d56d252b6e9afd9c990c8131113c50afec0ddb1abe2a27",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-011133",
            "import_time": "2026-08-04T22:30:00.927916364Z",
            "modified_time": "2026-08-04T21:37:15Z",
            "sha256": "ba9f764c6a9e2e776e0415994fe89aed2856912d37347c3454e6720a6b234695",
            "source": "amazon-inspector",
            "versions": [
                "1.0.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / chain-analyze

Package

Name
chain-analyze
View open source insights on deps.dev
Purl
pkg:npm/chain-analyze

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "dist/sigchain-js.esm.js",
            "sha256": "58ef40cdb062b2ef5d8106a8ce20665147733c8c94ab4fdc6ef7b13e02d7c935",
            "tlsh": "1a63949d26e7a060815b70b56fdb94407129e00b68ccd82cbdac53958fd946c9bf2ff8"
        },
        {
            "path": "dist/sigchain-js.cjs.js",
            "sha256": "35cfc3d9c44c0b56ad6e6c42e988a074b6f1ff24ad54cbb0d6556d28a69a99fd",
            "tlsh": "f363939d26e7a060815b70b56fdb94407129e00b68ccd82cbdac53958fd946c9bf2ff8"
        },
        {
            "path": "package.json",
            "sha256": "a9df51eaa75421517ce4a76fc34ad05f1ed4bd3e20d1ec53335cd387cdb7b83e",
            "tlsh": "dd31c0a0cd14cda3d5c816ea1869424622254447c846fcac3392074d4f8f26fa1f6bae"
        }
    ],
    "package_integrity": [
        {
            "filename": "chain-analyze-1.0.2.tgz",
            "hashes": {
                "sha1": "7eb948087668001897ffffb289cb2ff9c8306b47",
                "sha512_sri": "sha512-7xhMbltF/u7WzsKH6EtkFNpkT4vEyjSVLQuHuoRr+nH2dSRCVzRXiFei6puV24U5kdlP8Z/fVGHi3kLIbB3/lA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chain-analyze/MAL-2026-11133.json"