{"id":"MAL-2026-10202","summary":"Malicious code in chain-await-dom (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c7412987df7a746c9128ca807cbd2222b340e3b4f8397620348fc62606a0f2b5)\nThe package's declared main entry `index.js` exports a factory `check()` that spawns a detached, unreferenced Node child process running `lib/vcall.js`, then returns a noop Express-shaped middleware as cover. `lib/vcall.js` fetches JavaScript from `https://api.jsonsilo.com/public/c6c0b393-932f-4ae1-8fca-23c6747f4acc` (a mutable JSON-storage endpoint) and executes the response body via `new Function.constructor('require', src)(require)`, with up to 5 retries. `lib/constants.js` also stores a base64-encoded secondary endpoint `DEV_API_KEY` decoding to `https://jsonkeeper.com/b/ZK45J`, consistent with fallback/staged remote-execution infrastructure. The module additionally re-exports the factory as `module.exports.pino = check`, mimicking the `pino` logger API, while the package name (`chain-await-dom`) and README describe unrelated functionality. Any consumer that requires this package triggers arbitrary remote code execution with full Node privileges; the detached+unref child process persists beyond the parent.\n","modified":"2026-07-12T21:01:54.349048982Z","published":"2026-07-12T20:47:51Z","database_specific":{"malicious-packages-origins":[{"sha256":"c7412987df7a746c9128ca807cbd2222b340e3b4f8397620348fc62606a0f2b5","source":"amazon-inspector","versions":["1.3.4"],"id":"IN-MAL-2026-009761","import_time":"2026-07-12T20:48:33.832560255Z","modified_time":"2026-07-12T20:47:51Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chain-await-dom/v/1.3.4"}],"affected":[{"package":{"name":"chain-await-dom","ecosystem":"npm","purl":"pkg:npm/chain-await-dom"},"versions":["1.3.4"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"1b1079116bb2f4ec55dd8aeedf9c91f3060d178c9168b6b15f1ce0fba7ba6260","tlsh":"aff0a35e30fb1469567220f5570f41217002e526392ad9d676cc53810f995662677ba4","path":"lib/vcall.js"},{"path":"index.js","sha256":"a8a42982be73e18609aa4e0c0ff2a27e7fbdb6fed4b48a85daf9231ff667fcca","tlsh":"cef0ac4636f5a7a052249e85ea0be8363cc2c4357301edb082cef5d50743a6c86bb5d8"},{"tlsh":"e2e02be278d87022ba4649f0943c458631528526740f7def01a70a4c0aed9813970ec5","path":"lib/constants.js","sha256":"f0be485061a3a8d768580035489ab78fd3e15bbe4a3d5000c8dba2336b11fa8b"}],"package_integrity":[{"filename":"chain-await-dom-1.3.4.tgz","hashes":{"sha512_sri":"sha512-YBf/X3srghwJROPhJfkm15isxgDryzc2hpO2dvCElWmsL7/s9+54zhQa6p4t8b+PMWXzXn4d1b6IWjnSnkfnzg==","sha1":"7d54f3748af153433b11789e19d9bedf4968e47a"}}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chain-await-dom/MAL-2026-10202.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}