{"id":"MAL-2026-10049","summary":"Malicious code in chai-await-dom (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e78d8b4da2e781df4437569123ba3913c3f0135bbef66addaa5766a109fdd98b)\nThe package impersonates a pino-style logger API but its exported middleware spawns a detached Node child process that runs lib/caller.js. caller.js retrieves a JavaScript payload from https://jsonkeeper.com/b/BPB86 (an anonymous paste-style host) and executes it in-process via `new Function.constructor('require', s)(require)`, granting the remote host arbitrary code execution with the installer's Node privileges. lib/const.js stores a base64-encoded sibling URL (https://jsonkeeper.com/b/ZK45J decoded from `aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1pLNDVK`), deliberately obfuscating the C2 destination. The package name (chai-await-dom) does not match its actual behavior or its impersonated logger API surface, consistent with a namespace-abuse lure carrying a remote-code-execution payload.\n","modified":"2026-07-09T16:31:53.656111936Z","published":"2026-07-09T15:34:20Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009141","modified_time":"2026-07-09T15:34:20Z","source":"amazon-inspector","versions":["1.3.7"],"sha256":"e78d8b4da2e781df4437569123ba3913c3f0135bbef66addaa5766a109fdd98b","import_time":"2026-07-09T16:20:44.915106032Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-await-dom/v/1.3.7"}],"affected":[{"package":{"name":"chai-await-dom","ecosystem":"npm","purl":"pkg:npm/chai-await-dom"},"versions":["1.3.7"],"database_specific":{"indicators":{"package_integrity":[{"filename":"chai-await-dom-1.3.7.tgz","hashes":{"sha1":"af909543f4befa2dbac1162b845d4c81add6d667","sha512_sri":"sha512-wpBlzO6vV66F2F+Uhl6itDPaJLcUv0qU48G/eO9pwHf2PUcZIarVpCnWOtuxnJ8pZHDWsOStzxFSPr870KIr4w=="}}],"evidence_files":[{"path":"lib/caller.js","sha256":"0eb54b2e747503e5eb4ef23794f55bd236c66a580bfec44e8c227fc3d7b6c73a","tlsh":"f601fe4e30fd201c42a120d55b1fa4327021e86b390ae4d5734cc7521fe656eae23fdd"},{"path":"lib/const.js","sha256":"9879ffb0bf61edef7e9b90ddc5fac9770c514c0cdecd9a07b15e8a677e6f8f74","tlsh":"8ac08c8351e4a89704301773610ca995f2a1d26f0c840b0331f594844a396a93840fbb"},{"path":"index.js","sha256":"32e82853dd646aac388b78f868241267a5e6483d847df3d4c843f8100590d469","tlsh":"30213f8175f111480658d9c8b569e5363ce3c4377207b9b0e9ecb7862bcf20c0272ad7"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-await-dom/MAL-2026-10049.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}