supersignaturenature@1.0.5

Analysis

supersignaturenature@1.0.5 is a trojanized clone of the Theta blockchain SDK. On import/require it decrypts an embedded token (DES, hardcoded password "password") — sourced from the `manager-thedate` dependency in the ESM build, or from `node_modules/tchain-api/apps/docs/app/rsa.db` in the CJS/UMD builds — and pipes the decrypted string into a detached `node` subprocess via stdin, executing it as code. The detached child runs with stdio ['pipe','ignore','ignore'] and is unref'd so it outlives the parent. The decrypted payload's contents are not visible statically, but the staging mechanism executes attacker-controlled code in a background node process on every import.