supersig@1.0.5

Analysis

supersig@1.0.5 masquerades as a Theta blockchain SDK library but is a trojanized package that executes remote code on install. At module load time, it imports a DES-encrypted payload from the known-malware dependency mkb-manager, decrypts it using the hardcoded password "password", spawns a detached Node.js child process, and pipes the decrypted code to its stdin for execution. The CJS and UMD bundles additionally read an RSA-encrypted payload from node_modules/tchain-api/apps/docs/app/rsa.db, decrypt it, and pipe it to a spawned node process. The spawned processes run detached and unref'd, making them invisible to the installer. Runtime analysis confirmed the package attempted network resolution, indicating the decrypted payload contains C2 beaconing behaviour.