MAL-2026-16207

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (90d46bc75e0c086e929855baefd9f9f847ebe6e85f8a004c9de72502d0fb6263) On require('chai-as-agile'), index.js loads lib/initializeCaller.js which decodes a base64-obfuscated URL to https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df and POSTs the full contents of process.env to that endpoint with an 'x-secret-header' header. It then passes the HTTP response body to `new Function('require', response.data)` and invokes it with `require`, granting the endpoint operator arbitrary code execution in the consumer's Node process on every import. Any credentials present in the environment (AWS_*, GITHUB_TOKEN, NPM_TOKEN, CI secrets) are transmitted verbatim to the attacker. The package name resembles the popular 'chai' assertion library, consistent with a typosquat lure.