GCVE-110-OSM-2026-10750

Package publishes as `mc-registry` with description 'Theta chain registry', but its README, badges, homepage layout, and package listing copy the legitimate hyperweb-io/chain-registry npm package. The README instructs users to `npm install theta-registry` and `import { assets, chains, ibc } from 'theta-registry'`, while the shipped name is `mc-registry` and the shipped API diverges from chain-registry by re-exporting `HttpProvider` from an unrelated third-party dependency `chain-analyze` (`^1.0.4`). The ESM entry `esm/index.js` performs `import { HttpProvider } from 'chain-analyze';` at top level, so any consumer that does `import 'mc-registry'` loads and executes `chain-analyze` code in the installer/consumer process. `chain-analyze` is not part of the chain-registry ecosystem and has no relationship to the advertised 'chain registry' data purpose. The internal accessor is named `loadPartnerVaultHttpProvider`, further indicating the module funnels callers into an unvetted HTTP provider from the injected dependency. Files `esm/mainnet/persistence/chain.js` and `mainnet/persistence/chain.js` contain `ping`/`POST` network patterns co-located with chain persistence logic. Judge assessment: This looks like a supply-chain compromise/typosquat that masquerades as a chain registry while importing and executing an unrelated dependency (`chain-analyze`) at top level through `esm/index.js`, which is consistent with attacker-controlled code execution in the consumer process. The package also carries a large set of suspicious TLDs and hardcoded IP/URL indicators across many chain files, including `yara-shady-tld` hits like `vinjan.xyz`, `roomit.xyz`, and `validatrium.club`, which are not normal for a benign registry package. The OSV advisory’s claim that `mc-registry` copies the legitimate hyperweb-io/chain-registry branding but diverges in API and dependency behavior is corroborated by the metadata and the entrypoint design, and the publisher history includes another critical malware package (`supersig`), strengthening the attacker model. Given the combination of brand impersonation, untrusted dependency loading, and pervasive shady network infrastructure, this is malicious. ENTRY devnet/bitcannadevnet2/index.js (main: index.js) DESTINATION - 50 exfil (ethereumAddresses) (values recorded in verified_iocs) EXFIL - Suspicious Domain in devnet/bitwaydevnet/chain.js: "http://45.77.249.30" - Suspicious Domain in devnet/prysmdevnet/chain.js: "http://144.76.70.103" - Suspicious Domain in esm/devnet/bitwaydevnet/chain.js: "http://45.77.249.30" - Suspicious Domain in esm/devnet/prysmdevnet/chain.js: "http://144.76.70.103" - Suspicious Domain in esm/mainnet/bluechip/chain.js: "https://bluechipsblockexplorer.com" - Suspicious Domain in esm/mainnet/chain4energy/chain.js: "http://185.245.182.192" - Suspicious Domain in esm/mainnet/cifer/chain.js: "http://119.59.126.109" - Suspicious Domain in esm/mainnet/humans/chain.js: "http://65.21.46.90" (+14 more) OBFUSCATION - Base64 Encoded Payload in esm/mainnet/gateway/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/46Y..." - Base64 Encoded Payload in esm/mainnet/injective/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in esm/mainnet/kujira/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in esm/mainnet/osmosis/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in mainnet/gateway/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/46Y..." - Base64 Encoded Payload in mainnet/injective/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in mainnet/kujira/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in mainnet/osmosis/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." ADDITIONAL FINDINGS - Suspicious TLD Domain in devnet/prysmdevnet/chain.js: "https://rpc-prysm.vinjan.xyz" - Publisher Has Other Malicious Packages PAYLOAD FILES devnet/prysmdevnet/chain.js (+ esm/devnet/prysmdevnet/chain.js, esm/mainnet/chain4energy/chain.js)