MAL-2026-13942
Malicious code in chai-as-reformed (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (ae73388f2a877d421e53b37bdd36496a8048149ffe2e64a975e87c705f8b0e45) The package impersonates chai-as-promised and copies its README from pino, but its exported middleware spawns a detached `node lib/caller.js` process. caller.js base64-decodes a hardcoded jsonstorage.net URL (concealed together with an `x-secret-key` header name/value as base64 literals in a synthetic `process.env` object decoded with `atob`), fetches the JSON response, and passes its `cookie` field to `new Function.constructor("require", s)(require)`, executing attacker-controlled JavaScript in the host Node.js process with access to `require`. The remote payload is mutable and can be changed by the operator of the storage URL at any time.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for chai-as-reformed (npm). Pin to a known-safe version or switch to an alternative.