Malicious code in supersignaturenature (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ab1df02839294b29ff278b7a80505be50de75eb0f317f4bf29635236a75e4b15) The published dist/ bundles (main/module/browser entrypoints) contain code absent from the src/ tree: at library load they read an encrypted rsaToken from a package file via readRSAFromPackage(), DES-decrypt it using a key imported from the dependency manager-thedate, and pipe the plaintext into child_process.spawn('node', [],...) via stdin, executing the decrypted JavaScript in the installer's Node process. The DES key dependency is declared as "manager-thedate": "latest" in package.json, so the effective payload can be changed at any time by whoever controls that dependency, even though supersignaturenature itself is version-pinned. The src/ tree implements a straightforward Theta blockchain client with no fs, child_process, DES, or spawn usage; the shipped dist/*.js contains var child_process = require('child_process'), function decryptToken(token, password) using CryptoJS.DES.decrypt, readRSAFromPackage, and rsa_exec.stdin.write(String(rsaDecrypted)) against a spawned node process. The runtime code is not a rollup of the shipped source, so review of src/ does not reveal the loader that consumers actually execute.
Malicious code in supersignaturenature (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ab1df02839294b29ff278b7a80505be50de75eb0f317f4bf29635236a75e4b15) The published dist/ bundles (main/module/browser entrypoints) contain code absent from the src/ tree: at library load they read an encrypted rsaToken from a package file via readRSAFromPackage(), DES-decrypt it using a key imported from the dependency manager-thedate, and pipe the plaintext into child_process.spawn('node', [],...) via stdin, executing the decrypted JavaScript in the installer's Node process. The DES key dependency is declared as "manager-thedate": "latest" in package.json, so the effective payload can be changed at any time by whoever controls that dependency, even though supersignaturenature itself is version-pinned. The src/ tree implements a straightforward Theta blockchain client with no fs, child_process, DES, or spawn usage; the shipped dist/*.js contains var child_process = require('child_process'), function decryptToken(token, password) using CryptoJS.DES.decrypt, readRSAFromPackage, and rsa_exec.stdin.write(String(rsaDecrypted)) against a spawned node process. The runtime code is not a rollup of the shipped source, so review of src/ does not reveal the loader that consumers actually execute.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-15560
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a92f7d9acd9273b49e75a73
Added to database: 08/29/2026, 15:16:41 UTC
Last updated: 08/29/2026, 15:17:15 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.