MAL-2026-13703
Malicious code in chai-as-promised-plus (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (be02bee1e19ad24ae6091f0793dc22af62e54030388bbdc7d1aa29b078ac17a5) The package name mimics the widely-used chai-as-promised assertion helper and reuses its README/description. lib/chai-as-promised-plus.js defines the legitimate plugin factory and then overwrites module.exports with require('./config/config'), so any consumer that imports the package loads lib/config/config.js. That file is a 3,546,568-byte single-line javascript-obfuscator.io bundle (rotated string array of length 20721, two decoder functions, control-flow-flattening dispatcher of the form while(!![]){try{...}catch(o){y.push(y.shift())}}, hex-keyed object literals). A test-assertion helper has no legitimate need to ship a multi-megabyte obfuscated blob that replaces its exports at load time; the concealed payload runs in the consumer's Node.js process on require, which is the standard shape of a typosquat supply-chain attack delivering attacker-controlled code to the installer.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for chai-as-promised-plus (npm). Pin to a known-safe version or switch to an alternative.