Malicious code in mc-registry (npm)
The npm package mc-registry (versions 1.0.8 and 1.0.9) is a malicious package that impersonates the legitimate hyperweb-io/chain-registry package. It misleads users by copying the legitimate package's README and metadata but diverges in functionality by re-exporting an unrelated and unvetted HTTP provider from the chain-analyze dependency. This injected dependency executes code upon import and includes network communication patterns that may funnel users into potentially malicious HTTP interactions.
AI Analysis
Technical Summary
The mc-registry npm package publishes under the guise of 'Theta chain registry' but copies the legitimate chain-registry package's metadata to deceive users. Its shipped API differs by re-exporting HttpProvider from an unrelated third-party package, chain-analyze, which is not part of the chain-registry ecosystem. The top-level import of chain-analyze causes execution of its code in any consumer process importing mc-registry. Internal code references such as loadPartnerVaultHttpProvider and network communication patterns (ping/POST) suggest the package funnels consumers into unvetted HTTP providers, potentially enabling malicious network activity or data exfiltration.
Potential Impact
Users who install or import mc-registry versions 1.0.8 or 1.0.9 may unknowingly execute malicious code from the chain-analyze dependency. This can lead to unauthorized network communications initiated by the package, potentially exposing sensitive data or enabling further compromise of the consuming environment. The package's deceptive presentation increases the risk of inadvertent installation by developers expecting the legitimate chain-registry functionality.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing or using the mc-registry package, especially versions 1.0.8 and 1.0.9. Verify package authenticity by using the legitimate hyperweb-io/chain-registry package instead. Monitor package sources carefully and prefer packages with verified provenance. Since this is a malicious package impersonation, removal from projects and dependency trees is recommended if mc-registry is detected.
Malicious code in mc-registry (npm)
Description
The npm package mc-registry (versions 1.0.8 and 1.0.9) is a malicious package that impersonates the legitimate hyperweb-io/chain-registry package. It misleads users by copying the legitimate package's README and metadata but diverges in functionality by re-exporting an unrelated and unvetted HTTP provider from the chain-analyze dependency. This injected dependency executes code upon import and includes network communication patterns that may funnel users into potentially malicious HTTP interactions.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The mc-registry npm package publishes under the guise of 'Theta chain registry' but copies the legitimate chain-registry package's metadata to deceive users. Its shipped API differs by re-exporting HttpProvider from an unrelated third-party package, chain-analyze, which is not part of the chain-registry ecosystem. The top-level import of chain-analyze causes execution of its code in any consumer process importing mc-registry. Internal code references such as loadPartnerVaultHttpProvider and network communication patterns (ping/POST) suggest the package funnels consumers into unvetted HTTP providers, potentially enabling malicious network activity or data exfiltration.
Potential Impact
Users who install or import mc-registry versions 1.0.8 or 1.0.9 may unknowingly execute malicious code from the chain-analyze dependency. This can lead to unauthorized network communications initiated by the package, potentially exposing sensitive data or enabling further compromise of the consuming environment. The package's deceptive presentation increases the risk of inadvertent installation by developers expecting the legitimate chain-registry functionality.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing or using the mc-registry package, especially versions 1.0.8 and 1.0.9. Verify package authenticity by using the legitimate hyperweb-io/chain-registry package instead. Monitor package sources carefully and prefer packages with verified provenance. Since this is a malicious package impersonation, removal from projects and dependency trees is recommended if mc-registry is detected.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14294
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4b3acd9273b4925150b
Added to database: 08/19/2026, 13:50:43 UTC
Last enriched: 08/19/2026, 14:13:29 UTC
Last updated: 08/19/2026, 14:13:29 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.