chain-sdk-js is a malicious typosquatting npm package impersonating the legitimate @thetalabs/theta-js SDK. It decrypts and executes attacker-controlled code upon import, potentially compromising any system that installs it. The malicious payload is hidden in a separate dependency and performs outbound network activity. This package targets Theta blockchain developers who manage sensitive wallet and private-key data. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately.