GCVE-110-OSM-2026-10736

Package metadata describes `mc-provider` as 'Theta chain registry ⚛️' and the README is a verbatim copy of the hyperweb-io/chain-registry README instructing consumers to `import { assets, chains, ibc } from 'mc-provider'`. The actual main entry does not export any of those symbols. Instead, `index.js` dynamically loads an unrelated runtime dependency named `supersig` (`providerPromise = import('supersig').then((mod) => mod.HttpProvider)`) and re-exports `supersig`'s `HttpProvider` under this package's name; `esm/index.mjs` does the same via `import { HttpProvider } from 'supersig'; export { HttpProvider };`. Bundled chains/assets/IBC JSON files are present as decoys but are not reachable through the package's exports. Consumers following the README end up with a `supersig`-backed HTTP/RPC provider handling their Cosmos JSON-RPC and signing traffic — code they never chose to install, sourced from a package whose contents are outside this record. The impersonation of a well-known Cosmos registry package combined with silent resolution to an unrelated third-party provider is the standard shape used to insert attacker-controlled RPC/signing code into a wallet or dApp dependency tree. ENTRY devnet/bitcannadevnet2/index.js (main: index.js) DESTINATION - 50 exfil (ethereumAddresses) (values recorded in verified_iocs) EXFIL - Suspicious Domain in devnet/bitwaydevnet/chain.js: "http://45.77.249.30" - Suspicious Domain in devnet/prysmdevnet/chain.js: "http://144.76.70.103" - Suspicious Domain in esm/devnet/bitwaydevnet/chain.js: "http://45.77.249.30" - Suspicious Domain in esm/devnet/prysmdevnet/chain.js: "http://144.76.70.103" - Suspicious Domain in esm/mainnet/bluechip/chain.js: "https://bluechipsblockexplorer.com" - Suspicious Domain in esm/mainnet/chain4energy/chain.js: "http://185.245.182.192" - Suspicious Domain in esm/mainnet/cifer/chain.js: "http://119.59.126.109" - Suspicious Domain in esm/mainnet/humans/chain.js: "http://65.21.46.90" (+14 more) OBFUSCATION - Base64 Encoded Payload in esm/mainnet/gateway/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/46Y..." - Base64 Encoded Payload in esm/mainnet/injective/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in esm/mainnet/kujira/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in esm/mainnet/osmosis/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in mainnet/gateway/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/46Y..." - Base64 Encoded Payload in mainnet/injective/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in mainnet/kujira/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in mainnet/osmosis/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." ADDITIONAL FINDINGS - Suspicious TLD Domain in devnet/prysmdevnet/chain.js: "https://rpc-prysm.vinjan.xyz" - Brand New Package - Publisher Has Other Malicious Packages PAYLOAD FILES devnet/prysmdevnet/chain.js (+ esm/devnet/prysmdevnet/chain.js, esm/mainnet/chain4energy/chain.js)