MAL-2026-12348
Malicious code in chai-as-rendered (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (545ba2341881e666831e81156a815fdfac738830ec2918167e4c5fd3c42294bf) Typosquat of chai-as-promised. The package's exported middleware spawns a detached child process (lib/caller.js) that fetches a JSON payload from a base64-obfuscated jsonstorage.net URL (https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f) and evaluates the returned.cookie string via new Function.constructor("require", s)(require), giving the fetched code full require access on the installer's host. The remote URL and request headers are stored as base64 strings under fake process.env names (DEV_API_KEY, DEV_SECRET_KEY, DEV_SECRET_VALUE) and decoded with atob() at runtime to conceal the destination. The package name and keywords (fast, logger, stream, json) impersonate pino while the package name typosquats chai-as-promised.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for chai-as-rendered (npm). Pin to a known-safe version or switch to an alternative.