mc-provider@1.0.10

Analysis

mc-provider depends on the malicious package supersig. When supersig is loaded it reads a DES-encrypted token (from node_modules/tchain-api/apps/docs/app/rsa.db, or a key supplied by the mkb-manager dependency), decrypts it with the hardcoded password "password", then spawns a detached node process and pipes the decrypted payload into its stdin for execution. This is a multi-stage dropper that runs an encrypted second-stage payload in a background process on install/require.