The sigchain-js npm package versions 1.0.0 and 1.0.1 contain malicious code embedded only in the published distribution bundles (dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js). This code reads an encrypted payload from companion packages (thedata and tchain-api), decrypts it using a hardcoded DES password "hydra", and executes the decrypted code by spawning a detached Node.js child process and piping the payload into its stdin. The malicious code is absent from the source tree and only present in the distributed bundles, indicating post-source tampering or supply chain compromise. The package also pins [email protected], a version that does not exist in the official axios release history, causing the installer to fetch a malicious squatted package. This results in arbitrary code execution on any system that installs or imports sigchain-js, controlled by whoever maintains the companion packages.

Importing or requiring sigchain-js versions 1.0.0 or 1.0.1 leads to arbitrary code execution on the host system. The executed code is controlled by the attacker who publishes updates to the companion packages thedata and tchain-api. This can lead to full compromise of the host environment where the package is installed or used. The malicious axios dependency further increases risk by redirecting to a malicious package, potentially affecting other dependencies or code.

No official patch or remediation is currently available for sigchain-js versions 1.0.0 and 1.0.1. Users should immediately avoid installing or importing this package and remove any existing installations. Verify dependencies carefully and avoid packages with suspicious or squatted dependencies such as [email protected]. Monitor vendor advisories or trusted sources for updates or official fixes. Consider using package integrity verification tools and supply chain security measures to detect tampered packages.