The supersig npm package version 1.0.5 ships with malicious code embedded in its distributed bundles (dist/supersig.cjs.js, dist/supersig.esm.js, dist/supersig.umd.js) that is absent from the source code repository. This code imports a DES key from the unpinned mkb-manager@latest dependency, decrypts an embedded encrypted token to obtain plaintext code, and executes it by spawning a new Node.js child process and writing the decrypted code to its stdin. Because mkb-manager is pinned to latest, the attacker controlling mkb-manager can rotate the decryption key and payload at will, enabling dynamic and opaque malicious code execution. The concealment of this behavior from the source tree indicates deliberate obfuscation to evade detection.

Any user or system that installs and imports supersig version 1.0.5 will execute attacker-controlled code at load time, potentially leading to arbitrary code execution. The dynamic nature of the payload, controlled via the mkb-manager dependency, allows the attacker to modify the malicious behavior post-installation, increasing the risk and complexity of detection and mitigation.

No official patch or remediation is currently documented. Users should avoid using supersig version 1.0.5. Since the malicious code is embedded in the distributed bundles and relies on the mkb-manager@latest dependency, removing or replacing supersig with a trusted alternative is recommended. Monitor vendor advisories for any updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.