{"id":"MAL-2026-10406","summary":"Malicious code in async-chain-dom (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0f2ce6eed4ea7607d2f12f602b43b354b91ceba4cabdc761f569c3e1dc29b6f6)\nOn require, index.js spawns a detached, unref'd `node lib/vcall.js` child process. lib/vcall.js fetches JavaScript from https://api.jsonsilo.com/public/df71fd55-4f0c-4326-9b5b-a285e38023a5, extracts the `.model` field from the response, and executes it via `new Function.constructor(\"require\", src)` with `require` passed in, giving the remote endpoint arbitrary code execution inside the installer's Node process. The detached+unref pattern decouples the loader from the parent lifecycle so it persists after the consumer process exits, and a retry loop keeps the fetch running. The package masquerades as the pino logger (module.exports.pino = vCheck; keywords fast/logger/stream/json; lib files mimicking pino) despite the name async-chain-dom, providing a cover story for a developer to require it. The remote endpoint is a mutable jsonsilo.com blob under attacker control, so the executed payload can be swapped at any time.\n","modified":"2026-07-13T07:47:00.833199526Z","published":"2026-07-13T06:49:36Z","database_specific":{"malicious-packages-origins":[{"sha256":"0f2ce6eed4ea7607d2f12f602b43b354b91ceba4cabdc761f569c3e1dc29b6f6","source":"amazon-inspector","versions":["1.3.5"],"id":"IN-MAL-2026-009831","import_time":"2026-07-13T07:40:11.724670518Z","modified_time":"2026-07-13T06:49:36Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/async-chain-dom/v/1.3.5"}],"affected":[{"package":{"name":"async-chain-dom","ecosystem":"npm","purl":"pkg:npm/async-chain-dom"},"versions":["1.3.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"e9f0a35f30fa20594a3760f5670f81216102d53a390eedda72cc43514fd946626b7bd0","path":"lib/vcall.js","sha256":"277f1492a353d0bea073792f7110ebdf3b266dcca9c6fe09979711e10cbc8498"},{"path":"index.js","sha256":"a5746f11a2fd192d52377570a8abcf99976464fb3da13acbb494a13c4ab0ed57","tlsh":"07f0ac4636f5a7a023249ec5fa0ae8372cc2c4317301ecb0d2ceb5e20743a6c86b74d8"},{"tlsh":"58f04460cc788e6305ec2596482a0242a6a19c176818fc2933d7611c4f9d5fb15be22e","path":"package.json","sha256":"4847837b9dceab4063ebd703db1aaf493306602589af89e70d1470ebf6969b79"}],"package_integrity":[{"filename":"async-chain-dom-1.3.5.tgz","hashes":{"sha512_sri":"sha512-YTGt1yZcDVpHMTqWtUWmk1a24CtKl3MnUE7uqP9twE+7mRh4rUnP690J0wXPSxHCaVofK2aAB0P3Gt0Xbp6rzQ==","sha1":"e3cbf849386d2f950a9964e079aad91f3d631e87"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/async-chain-dom/MAL-2026-10406.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}