The chain-api-sdk package masquerades as the upstream multichain-crypto-wallet library by copying its README, badges, repository URL, and homepage. Unlike the legitimate library, it depends on a malicious package, mchain-sdk, which executes code immediately upon import. This behavior occurs in a sensitive wallet environment handling private keys and mnemonic data, making it a dependency-chain dropper. The malicious code can fully compromise any system where the package is installed, risking all stored secrets and keys. The affected versions are 0.2.10, 0.2.11, and 0.2.12. There is no CVSS score or known exploits in the wild reported yet.

Systems with chain-api-sdk versions 0.2.10, 0.2.11, or 0.2.12 installed should be considered fully compromised. The malicious code executes in the context of wallet operations, potentially exposing private keys, mnemonics, and encrypted keystore data. This can lead to complete loss of control over secrets and keys stored on the affected system.

Remove the chain-api-sdk package immediately from all affected systems. Rotate all secrets and keys that were stored or managed on the compromised systems using a separate, trusted environment. Due to the high risk of full system compromise, assume that the attacker may have persistent access and take appropriate incident response measures. No official patch or fix is available; avoidance and removal are the only mitigations.