mc-reg (npm) · Malicious Code
Affects mc-regSource GCVE Database
Malicious package : remove mc-reg and rotate any secrets on hosts that installed it.
Data as of 26 Oct 2026, 15:56 UTC
Malicious package
Published to npm · OSV MAL-2026-10637
What to do
Remove mc-reg from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmmc-reg | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package mc-reg, advertised as a Cosmos chain-registry data package, contains malicious code that intercepts and exfiltrates wallet secrets. Instead of exposing expected chain-registry data, it imports a dependency (chain-sdk-js) whose code steals BIP-39 mnemonic phrases and private keys by sending them to a hardcoded external host. The mc-reg package acts as a lure to route users into this malicious code path upon installation or import.
References
- npmjs.com/package/mc-reg/v/1.0.3 (opens in a new tab)
- npmjs.com/package/mc-reg/v/1.0.4 (opens in a new tab)
- npmjs.com/package/mc-reg/v/1.0.8 (opens in a new tab)
- github.com/advisories/GHSA-hvhc-6qpw-v5r9 (opens in a new tab)
- npmjs.com/package/mc-reg/v/1.0.6 (opens in a new tab)
- npmjs.com/package/mc-reg/v/1.0.5 (opens in a new tab)
- npmjs.com/package/mc-reg/v/1.0.7 (opens in a new tab)
- npmjs.com/package/mc-reg/v/1.0.2 (opens in a new tab)