MAL-2026-14305

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mc-provider/MAL-2026-14305.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14305
Published
2026-08-19T19:11:52Z
Modified
2026-08-19T19:31:20.650588478Z
Summary
Malicious code in mc-provider (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e494af2871662b1b342a26141de010623484dfef353b505805f4b41d85d775c1)

Package metadata describes mc-provider as 'Theta chain registry ⚛️' and the README is a verbatim copy of the hyperweb-io/chain-registry README instructing consumers to import { assets, chains, ibc } from 'mc-provider'. The actual main entry does not export any of those symbols. Instead, index.js dynamically loads an unrelated runtime dependency named supersig (providerPromise = import('supersig').then((mod) => mod.HttpProvider)) and re-exports supersig's HttpProvider under this package's name; esm/index.mjs does the same via import { HttpProvider } from 'supersig'; export { HttpProvider };. Bundled chains/assets/IBC JSON files are present as decoys but are not reachable through the package's exports. Consumers following the README end up with a supersig-backed HTTP/RPC provider handling their Cosmos JSON-RPC and signing traffic — code they never chose to install, sourced from a package whose contents are outside this record. The impersonation of a well-known Cosmos registry package combined with silent resolution to an unrelated third-party provider is the standard shape used to insert attacker-controlled RPC/signing code into a wallet or dApp dependency tree.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T19:12:49.598881581Z",
            "sha256": "e494af2871662b1b342a26141de010623484dfef353b505805f4b41d85d775c1",
            "modified_time": "2026-08-19T19:11:52Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018427",
            "versions": [
                "1.0.10"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / mc-provider

Package

Name
mc-provider
View open source insights on deps.dev
Purl
pkg:npm/mc-provider

Affected ranges

Affected versions

1.*
1.0.10

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mc-provider/MAL-2026-14305.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "7eb79346553140e6193fa63f46ef9e4ac24508067ba7c3acd59f3556cb5d902a",
            "tlsh": "2631f8ba79e3609143127fbc7e8e5c47e69c145320188e64791e9770dfc3c248ea46ca",
            "path": "index.js"
        },
        {
            "sha256": "711160dbb5b8941d5ac1964eaa39d678ff26663eb6824245e57ebbf3da4946f8",
            "tlsh": "cc219061caa08c2306c92ca8bc994582f5722c5b8548bc4d33d7916ccf8e4bb50fe6ad",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "mc-provider-1.0.10.tgz",
            "hashes": {
                "sha512_sri": "sha512-pPgSPmirYO/ev7PA/zej9ReYgMmDaR47+Qt7xPCOCfjWxFEhLB6u7T0cWn0OSNY1oeVyCzBAuZi0IDzP+yTqig==",
                "sha1": "762e7cab8edb91886fd7f1e6bfc8d7c04d0b06e4"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]