The theta-sdk-js npm package versions 1.2.14 through 1.2.17 include malicious code in the src/decrypt.js and src/providers/BaseProvider.js files. On module load, decrypt.js reads encrypted blobs from a sibling package (tchain-api) and decrypts them with a hardcoded password 'hydra'. BaseProvider.js then spawns detached Node.js child processes, feeding the decrypted payload for execution and detaching the child process to outlive the parent. The main entrypoint file is clean, but the malicious code is triggered when consumers import subpaths or use bundlers that resolve the src/index.js file. This design, including encrypted payloads in a runtime dependency and execution in detached processes, is a clear evasion tactic and malicious behavior.

This malicious code enables execution of hidden payloads on systems that install and import the affected theta-sdk-js package versions in a way that triggers the src code (e.g., subpath imports or certain bundlers). This can lead to unauthorized code execution, persistence via detached child processes, and potential compromise of the host environment. No known exploits in the wild have been reported yet.

No official patch or remediation is currently documented. Users should avoid installing or using theta-sdk-js versions 1.2.14, 1.2.15, 1.2.16, and 1.2.17. Remove these versions from projects and replace them with trusted alternatives. Monitor for updates or advisories from the package maintainers or npm registry for any official fixes or removals. Since this is a malicious package, consider scanning existing environments for its presence and removing it.