The npm package mc-reg, advertised as a Cosmos chain-registry data package, contains malicious code that intercepts and exfiltrates wallet secrets. Instead of exposing expected chain-registry data, it imports a dependency (chain-sdk-js) whose code steals BIP-39 mnemonic phrases and private keys by sending them to a hardcoded external host. The mc-reg package acts as a lure to route users into this malicious code path upon installation or import.