If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (5dc78815e8c40947273929a7224aa04230de911771e62580045fb8bb213468c9)
The package publishes as 'log-min' with a description claiming it is a JavaScript library for the Theta Blockchain, while its README identifies the project as 'chain-sdk-js' — an impersonation of the Theta chain-sdk-js SDK. package.json declares postinstall 'node src', which loads src/providers/BaseProvider.js. That module's top-level IIFE imports an opaque blob 'desKey' from the 'thedata' npm dependency, DES-decrypts it with the hardcoded password 'hydra', spawns a detached 'node' child process with piped stdin and ignored stdio, writes the decrypted code into the child's stdin, and unrefs the child so it survives the installer. The identical decrypt-and-exec pattern is also present at the top level of the shipped CJS bundle dist/log-min.cjs.js, so the dropper fires both at 'npm install' via the postinstall hook and whenever any consumer require()s the package. The executed bytes originate in a separate dependency ('thedata') and are not present in the log-min tarball, giving the author of that dependency arbitrary code execution on any machine that installs or imports log-min.