{"id":"MAL-2025-191566","summary":"Malicious code in chai-promise-chain (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a4ecbe8f1fc2ecc76ad2c336265b5750a854b1e0cf54067d357cd5638ad5c501)\nThe package chai-promise-chain was found to contain malicious code.\n","aliases":["SNYK-JS-CHAIPROMISECHAIN-14152242"],"modified":"2026-03-19T12:41:49.715475Z","published":"2025-12-01T13:05:08Z","database_specific":{"malicious-packages-origins":[{"id":"RLMA-2025-05700","import_time":"2025-12-02T09:09:42.599531869Z","modified_time":"2025-12-01T13:05:08Z","sha256":"61eed775dddd14b292112da90b442b328984904cd92612ab9417edeb2fe143f1","source":"reversing-labs","versions":["2.2.6","2.2.8","2.3.2"]},{"import_time":"2025-12-02T21:35:55.513994671Z","modified_time":"2025-12-02T21:11:00Z","sha256":"a4ecbe8f1fc2ecc76ad2c336265b5750a854b1e0cf54067d357cd5638ad5c501","source":"amazon-inspector","versions":["2.2.6","2.2.8","2.3.2"]},{"source":"reversing-labs","versions":["2.4.1"],"id":"RLUA-2025-06090","import_time":"2025-12-24T10:07:34.350491919Z","modified_time":"2025-12-23T08:02:19Z","sha256":"b9865367b1c8089af66ae916298c0c2485d82c8528a187296fc47de0e0a5694c"},{"import_time":"2026-03-19T12:20:51.516372425Z","modified_time":"2026-03-18T12:43:08Z","sha256":"d46a0747dad22e0b09adf84409f31d03287be67aca584afacd777c9a2e836980","source":"reversing-labs","id":"RLUA-2026-01179"}]},"references":[{"type":"ARTICLE","url":"https://socket.dev/blog/north-korea-contagious-interview-npm-attacks"},{"type":"ARTICLE","url":"https://thehackernews.com/2025/11/north-korean-hackers-deploy-197-npm.html"},{"type":"ADVISORY","url":"https://security.snyk.io/vuln/SNYK-JS-CHAIPROMISECHAIN-14152242"}],"affected":[{"package":{"name":"chai-promise-chain","ecosystem":"npm","purl":"pkg:npm/chai-promise-chain"},"versions":["2.2.6","2.2.8","2.3.2","2.4.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-promise-chain/MAL-2025-191566.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}