The mc-reg package advertises itself as a legitimate Cosmos chain-registry data package but does not expose the expected data. Instead, its main and ESM entrypoints import and re-export a component from the unrelated chain-sdk-js package. This dependency contains malicious code in persistence/chain.js that intercepts wallet secrets and exfiltrates them via POST requests to a hardcoded destination reconstructed from character codes. This behavior matches theft of BIP-39 mnemonic phrases and private keys from wallet or signing paths. Thus, installing or importing mc-reg results in the inadvertent inclusion of malicious code that compromises wallet security.

Users who install or import mc-reg versions 1.0.3 or 1.0.4 risk having their wallet secrets, including mnemonic phrases and private keys, intercepted and sent to an attacker-controlled host. This can lead to complete compromise of cryptocurrency wallets and loss of funds. The package acts as a supply chain attack vector by masquerading as a benign data package while delivering malicious code.

No official patch or remediation is currently documented for mc-reg. Users should avoid installing or importing mc-reg versions 1.0.3 and 1.0.4. Audit dependency trees for inclusion of mc-reg or chain-sdk-js and remove these packages if found. Monitor vendor advisories for updates or fixes. Since this is a malicious package, consider using trusted package sources and supply chain security tools to detect such threats.