chain-api-sdk@0.2.10

Analysis

chain-api-sdk is a multichain crypto wallet library that depends on mchain-sdk, a known-malicious package published by the same account. When installed, chain-api-sdk loads mchain-sdk at runtime, executing its malicious payload. The package has no install hooks of its own, making the dependency on known malware the sole attack vector — the malicious code is delivered transitively through the dependency tree.