{"id":"MAL-2026-16077","summary":"Malicious code in chai-as-sleek (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (782914cb65e0d30697eb54f50a4c5b740a3a53941abc185759e296c1d2ec8e9e)\nPackage published as 'chai-as-sleek' impersonates the pino logger: README, LICENSE, docs/, and index.d.ts are copied verbatim from pino, while package.json description reads 'This document describes the management of vulnerabilities...' and the README also markets the package as a chai plugin. The main entrypoint index.js unconditionally executes `require('./lib/config')` at load time. lib/config.js is a single ~4 MB line of obfuscator.io-obfuscated JavaScript (23,868-entry rotated string array, decoder functions T and j, control-flow flattening, ~20k decoder-wrapper calls) with no configuration content. package.json declares `axios ^1.10.0` as a runtime dependency, but no readable source file imports axios — the only reachable consumer of the HTTP client is the opaque blob in lib/config.js. Any consumer that imports 'chai-as-sleek' executes this hidden payload at require() time with outbound HTTP capability provisioned.\n","modified":"2026-09-09T07:00:09.790467692Z","published":"2026-09-09T06:49:23Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-09-09T06:54:01.295527278Z","modified_time":"2026-09-09T06:49:23Z","sha256":"782914cb65e0d30697eb54f50a4c5b740a3a53941abc185759e296c1d2ec8e9e","source":"amazon-inspector","versions":["7.1.2"],"id":"IN-MAL-2026-019847"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-sleek/v/7.1.2"}],"affected":[{"package":{"name":"chai-as-sleek","ecosystem":"npm","purl":"pkg:npm/chai-as-sleek"},"versions":["7.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"f016818d5685d42381cc2793be057ae9b17ae96684cca447ff74bf1c69bc41bc2a0ed0","path":"lib/config.js","sha256":"df4970a67c9caae5dd2e4603ea726f7624a4c17bb197a1039985a10ff9b56923"},{"path":"package.json","sha256":"cbe9ebb8aa8e34a0ba93790ce750f864c3cf9854bd7d1deabd8a982d8c924a28","tlsh":"c6017b20da785e2304ed25425c2a0603b6614c579528fd1932dba12c4f9d5fb01bf21d"}],"package_integrity":[{"filename":"chai-as-sleek-7.1.2.tgz","hashes":{"sha512_sri":"sha512-ODrLagHQLbSHHqYBdtn3ckGXGFT+2EwmXyAC5GZWO3EoUQPQ8MWXEVeABCEhY507IIejmLq/choSvz59BX+2uw==","sha1":"bc2bf2596e535cb196e1632b0e18e826ebf42f84"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-sleek/MAL-2026-16077.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}