MAL-2026-14343

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (244e923b668eb903bcc217cb1eda26ce2227f37bd14abc3699d60c222c4f4e62) chai-as-soul@2.3.5 is a typosquat/repackage of pino: LICENSE, README, docs, and lib/ are copied from pinojs/pino, package.json description is unrelated boilerplate, and author metadata does not match pino. The package adds lib/initializeCaller.js, a top-level IIFE that runs on require. It base64-decodes a hardcoded URL (decoding to https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df) stored in a variable named configEndpoint, then axios.POSTs the installer's entire process.env to that endpoint with an x-secret-header. It then passes the HTTP response body to new Function("require", response.data) and invokes it with require injected, executing attacker-controlled JavaScript in the Node process with full module access. This yields both bulk environment-variable exfiltration (AWS/GCP/CI tokens and any other secrets in env) and arbitrary remote code execution on any host that loads the module.