{"id":"MAL-2026-10135","summary":"Malicious code in theta-sdk-js (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6967c021e95228b33b18be4489fea5d404720cbd21beb53dac8bf7ea4f4d54d1)\ntheta-sdk-js@1.2.15 ships src/decrypt.js and src/providers/BaseProvider.js which together implement a hidden execution channel. On module load, decrypt.js reads two encrypted blobs (rsa.db, des.db) from node_modules/tchain-api/apps/docs/app/, DES-decrypts them using the hardcoded password 'hydra' via crypto-js, and returns the plaintext. Top-level IIFEs in src/providers/BaseProvider.js spawn detached `node` child processes (`spawn('node', [], { detached: true, stdio: ['pipe','ignore','ignore'] })`), pipe the decrypted plaintext into stdin for execution, and call `unref()` so the child outlives the parent. The runtime dependency `tchain-api@^1.2.5` — declared in package.json — supplies the encrypted payload files, so `npm install theta-sdk-js` automatically stages the payload host. The distributed `dist/thetajs.cjs.js` (declared as `main`) is clean and does not contain this code; the dropper lives only in the src/ tree that is also shipped in the tarball, so consumers that import subpaths or use bundlers/tree-shakers that resolve src/index.js trigger the execution. Encrypting the payload in a sibling package with a hardcoded key, splitting the malicious code away from the declared entrypoint, and executing decoded plaintext in a detached child process are hallmarks of deliberate evasion, not legitimate SDK behavior.\n","modified":"2026-07-10T19:16:58.276780953Z","published":"2026-07-10T16:15:18Z","database_specific":{"malicious-packages-origins":[{"sha256":"48d9dc8bff360e02b99abc0444b2ec316b266c7356e605aea830557a088cab98","id":"IN-MAL-2026-009636","source":"amazon-inspector","versions":["1.2.16"],"import_time":"2026-07-10T16:19:43.940359254Z","modified_time":"2026-07-10T16:15:18Z"},{"sha256":"6967c021e95228b33b18be4489fea5d404720cbd21beb53dac8bf7ea4f4d54d1","id":"IN-MAL-2026-009638","source":"amazon-inspector","versions":["1.2.15"],"import_time":"2026-07-10T16:19:44.176573801Z","modified_time":"2026-07-10T16:15:39Z"},{"sha256":"a34b7ee47f055b1a354af0ab7cac7bd711227f8c2ac6961db57bb86079ff18b8","id":"IN-MAL-2026-009637","source":"amazon-inspector","versions":["1.2.14"],"import_time":"2026-07-10T16:19:44.070943101Z","modified_time":"2026-07-10T16:15:30Z"},{"sha256":"a8eef53649e3917a947322640676f3e4448391bba73e8095b249b78efee0e5c5","id":"IN-MAL-2026-009711","source":"amazon-inspector","versions":["1.2.17"],"import_time":"2026-07-10T19:02:49.017525485Z","modified_time":"2026-07-10T18:46:40Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/theta-sdk-js/v/1.2.16"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/theta-sdk-js/v/1.2.15"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/theta-sdk-js/v/1.2.14"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/theta-sdk-js/v/1.2.17"}],"affected":[{"package":{"name":"theta-sdk-js","ecosystem":"npm","purl":"pkg:npm/theta-sdk-js"},"versions":["1.2.16","1.2.15","1.2.14","1.2.17"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/theta-sdk-js/MAL-2026-10135.json","indicators":{"evidence_files":[{"sha256":"ead8f032b34ef870738e444ce7c1301077b51bb20a7daba1c12e041eb68ed9cf","path":"dist/thetajs.cjs.js","tlsh":"ac63939d26e7a060815b70b56fdb94407129e01b68ccd82cbdac43958fd946c9bf2ff8"},{"sha256":"1cc20fa1a130d16b9fe04327e513ff8e284398367d84ecdaf3974c3d0258ca36","path":"src/decrypt.js","tlsh":"5b31c0841dda57a9cbf45be6a361c4138e7a10643916c7a4b0ddcbd53a848b88da2cdc"},{"sha256":"2de8079101ca79dd069ee964f5cacb1989320447a322cc1679a6933ab5c62974","path":"package.json","tlsh":"c231ef20de25ceb319c815a828694167b02598474c47fc7c33a10b4d8f4e27f31fabae"}],"package_integrity":[{"hashes":{"sha1":"51d1500536b4afc42d94dca999111c1dd146b1c7","sha512_sri":"sha512-qh/MUVsuNZhTuhQOfGgX4f0n4EuX+PukZCU66uEpMIRKwLUZ7X13INWFQpeBUJYccWKvhHdSXVC0/YIbNUmZQQ=="},"filename":"theta-sdk-js-1.2.16.tgz"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}