Malicious code in mc-provider (npm)

The 'mc-provider' npm package falsely presents itself as a Cosmos chain registry by copying legitimate README content and bundling decoy JSON files. However, its main entry point dynamically imports the unrelated 'supersig' package and re-exports its HttpProvider, redirecting RPC and signing traffic to attacker-controlled code. This behavior enables silent injection of malicious RPC/signing functionality into wallets or decentralized applications that depend on 'mc-provider'. The package's presence indicates a full system compromise risk.

Any system with 'mc-provider' version 1.0.10 installed or running should be considered fully compromised. Attackers gain control over RPC and signing operations, potentially exposing all secrets and keys stored on the system. Removal of the package alone does not guarantee eradication of all malicious software introduced. Immediate rotation of all secrets and keys from a separate, trusted system is necessary.

Remove the 'mc-provider' package version 1.0.10 immediately. Rotate all secrets and keys stored on the affected system from a different, secure computer. Due to the high risk of full system compromise, consider a full system audit and reinstallation from trusted sources. No official patch or fix is available; avoidance and removal are the only mitigations.