MAL-2026-11146

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sigchain-js/MAL-2026-11146.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11146
Published
2026-07-28T13:36:13Z
Modified
2026-07-28T14:37:11.232235982Z
Summary
Malicious code in sigchain-js (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (034ba6bdd11139e40b062606dfa180a60727249035899eded96d34797b63a026)

The published dist bundles (dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js) contain top-level code that reads an encrypted payload from a companion package (esm imports desKey from the thedata package; cjs/umd reads node_modules/tchain-api/apps/docs/app/rsa.db), DES-decrypts it using the hardcoded password "hydra", spawns a detached node child process, and pipes the decrypted string into that subprocess's stdin for execution. This code is not present in the src/ tree — it appears only in the published dist bundles, along with new top-level imports of child_process, node:fs, node:path, and (esm) desKey from thedata that do not exist in source. The dropper is split across cooperating packages: thedata (declared as a direct dependency) supplies the encrypted payload for the esm build, and tchain-api (a look-alike of Theta's official API SDK, pulled in transitively) supplies apps/docs/app/rsa.db for the cjs/umd builds. The package also pins axios@1.18.1, a version that does not exist in the legitimate axios release history, redirecting the installer to a squatted namesake. Requiring or importing sigchain-js results in arbitrary code execution on the installer's host, with the executed content controlled by whoever publishes updates to the companion packages.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "034ba6bdd11139e40b062606dfa180a60727249035899eded96d34797b63a026",
            "import_time": "2026-07-28T14:19:59.058435965Z",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-010918",
            "modified_time": "2026-07-28T13:36:13Z"
        }
    ]
}
References
Credits

Affected packages

npm / sigchain-js

Package

Name
sigchain-js
View open source insights on deps.dev
Purl
pkg:npm/sigchain-js

Affected ranges

Affected versions

1.*
1.0.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "35cfc3d9c44c0b56ad6e6c42e988a074b6f1ff24ad54cbb0d6556d28a69a99fd",
            "tlsh": "f363939d26e7a060815b70b56fdb94407129e00b68ccd82cbdac53958fd946c9bf2ff8",
            "path": "dist/sigchain-js.cjs.js"
        },
        {
            "sha256": "b7235eeffd783b1eb05b6a699794148a7990a8345b860bb50776a3aeb09d8e5c",
            "tlsh": "6163949d26e7a060815b70b56fdb94407129e00b68ccd82cbdac53958fd946c9bf2ff8",
            "path": "dist/sigchain-js.esm.js"
        },
        {
            "sha256": "a0e4b135cdcc437031ffec05b47a80aadde1ade6ce25c23313d2e884902417e1",
            "tlsh": "e431f1b0cd65cdb315c805a92839514730289487c807f89c33960b4d4f4e26f72f6bbd",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "6a1d8c138a8370c60d5a10e2946ca170c1ea20df",
                "sha512_sri": "sha512-1xFMo/2RvwPNOgc1PI9/w4GIyCrPAnSmoqaJCiyfWJHyYtXmyJdbLsesDLDjTFKHQLpcpKKx7FSvSBeQpHXbQQ=="
            },
            "filename": "sigchain-js-1.0.1.tgz"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sigchain-js/MAL-2026-11146.json"