Malicious code in supersignaturenature (npm)

The supersignaturenature npm package versions 1.0.5 and 1.0.6 ship distribution bundles containing hidden malicious code absent from the source repository. At runtime, the package reads an encrypted rsaToken from its files, decrypts it using DES with a key imported from the dependency manager-thedate (declared as "latest" in package.json), and executes the decrypted JavaScript by piping it into a child Node.js process. This design allows the effective payload to be changed at any time by whoever controls the manager-thedate dependency, despite supersignaturenature itself being version-pinned. The source code only implements a Theta blockchain client without any filesystem, child_process, or cryptographic decryption usage, indicating the malicious code is injected only in the published bundles. This results in full compromise of any system running the package.

Systems with supersignaturenature versions 1.0.5 or 1.0.6 installed or running are fully compromised. The malicious code executes arbitrary JavaScript controlled by an external dependency, potentially allowing complete control over the affected system. All secrets and keys stored on the compromised machine should be considered exposed and must be rotated from a secure, unaffected system. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

No official patch or fix is currently documented. Immediate removal of supersignaturenature versions 1.0.5 and 1.0.6 is strongly recommended. All secrets and credentials on affected systems should be rotated from a different, uncompromised machine. Due to the nature of the compromise, a full system rebuild or forensic investigation may be necessary to ensure no persistent malicious code remains. Monitor for any unexpected child Node.js processes spawned by this package or its dependencies.