{"id":"MAL-2026-10041","summary":"Malicious code in chai-as-buffered (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3d136202d96267459c4bf3aaaf6c903d7bd2c491901b61dcf2f391a4612f951a)\nchai-as-buffered@3.7.24 is a typosquat lure (name resembles chai-as-promised; README and module exports impersonate the pino logger) whose actual behavior is a remote-payload dropper. lib/caller.js shadows `process` with a local object whose `env` holds base64-encoded constants for the C2 URL, header name, and header value, hiding the destination from review and from env scanning. When the exported middleware is invoked (e.g., via `chai.use(...)` or `require('chai-as-buffered')` wiring through the pino-styled export), the package base64-decodes the hidden URL (https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/a179ea35-b962-4722-b3f1-e28316d1a44a), spawns a detached, stdio-ignored `node./lib/caller.js` child, fetches a JSON document from that mutable third-party blob, and passes the document's `cookie` field to `Function.constructor('require', s)` invoked with the live `require`. The fetched JavaScript executes with full `require` access on the installer's machine. The destination is an attacker-controlled mutable JSON store whose content can be changed at any time, giving the publisher arbitrary code execution against any environment that loads this package.\n","modified":"2026-07-09T16:31:52.377977533Z","published":"2026-07-09T15:34:29Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["3.7.24"],"id":"IN-MAL-2026-009142","import_time":"2026-07-09T16:20:44.991110418Z","modified_time":"2026-07-09T15:34:29Z","sha256":"3d136202d96267459c4bf3aaaf6c903d7bd2c491901b61dcf2f391a4612f951a"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-buffered/v/3.7.24"}],"affected":[{"package":{"name":"chai-as-buffered","ecosystem":"npm","purl":"pkg:npm/chai-as-buffered"},"versions":["3.7.24"],"database_specific":{"indicators":{"evidence_files":[{"path":"lib/caller.js","sha256":"37e9dde0f35864e2ea8dcd4c8b5324ef50e3798195d04c30ba6938352af702db","tlsh":"1b01af9934fe541c015112e9171fa1326050e4673d86e6c83b4c87129fa667e6e93adf"},{"path":"README.md","sha256":"17cd229f31776e3ec9aa3b66bae74a12e284d34647115c09740b0644864b4c8a","tlsh":"6d51b5a786e86b6e4b6300b2a1c339b9ff5f931cbf29606ddcd8913903198d3803150a"}],"package_integrity":[{"filename":"chai-as-buffered-3.7.24.tgz","hashes":{"sha1":"831226e1498f40bb9a94dacb6dd367a20aa3a21f","sha512_sri":"sha512-LvN5wIMxskyIWrcxhcI1HXFMQtOooJlrZ9fAEcp/OWFQ+LQrxIMA0NBzlK6UMup/Jm/GOnQXnZtGVSQsZ9zQeg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-buffered/MAL-2026-10041.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}