Malicious code in chain-analyze (npm)

The npm package chain-analyze was published with malicious code embedded in its dist bundle files (dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js). The code executed automatically on module load, reading an encrypted blob from a sibling dependency named 'chain-manager', decrypting it with a hardcoded password, and spawning a detached Node.js child process to execute the decrypted attacker-controlled script.

The package impersonated the official @thetalabs/theta-js SDK by declaring the author as 'Theta Labs' and describing itself as a JavaScript library for the Theta blockchain. The malicious code was present only in the dist/ directory; the src/ tree contained no reference to the attack infrastructure, allowing source reviewers to see a clean codebase while consumers received the tampered build.

The attack used a split-package design: chain-analyze pinned chain-manager ^1.0.9 as a dependency, which supplied the encrypted payload. This design hid the executable code from automated scanners that inspect only a single tarball. The declared main entry point in package.json (dist/chain-analyze.cjs.js) was not shipped; instead, only the malicious dist/sigchain-js.* bundles were published, ensuring consumers resolved to the compromised build.

The incident was identified and credited to the OpenSSF malicious-packages project.