{"id":"MAL-2026-16196","summary":"Malicious code in chai-as-crack (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (090c71f12df6d5441dce686e54fef42805f1afd6575d48bc0f6263dcf50b2f21)\nPackage's main entry (index.js) unconditionally requires./lib/config at top level, causing the file to execute on any require('chai-as-crack'). lib/config.js is approximately 4 MB of obfuscator.io-transformed code: a rotating string array of ~23,868 entries with hex-escaped identifiers, multiple decoder wrappers (T, j), and control-flow flattening. The exported middleware is a no-op decoy. Package metadata further disguises the module as the popular pino logger: package.json declares name chai-as-crack with keywords logger/stream/json, while README.md, docs/, index.d.ts, and LICENSE are copied verbatim from pino (linking to github.com/pinojs/pino). Author metadata (Robert King \u003chello@jsonspack.com\u003e, bugs URL https://jsonspack.com/issues) is unrelated to pino. The combination of import-time execution of an opaque multi-megabyte payload, heavy obfuscation with no source map or build artifacts, and a cover-story impersonating an unrelated well-known logger matches the loader/dropper shape and gives the publisher arbitrary code execution inside any consumer that imports the package.\n","modified":"2026-09-15T16:46:26.773245247Z","published":"2026-09-15T16:32:24Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["7.0.5"],"id":"IN-MAL-2026-020071","import_time":"2026-09-15T16:41:58.23645445Z","modified_time":"2026-09-15T16:32:24Z","sha256":"090c71f12df6d5441dce686e54fef42805f1afd6575d48bc0f6263dcf50b2f21"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-crack/v/7.0.5"}],"affected":[{"package":{"name":"chai-as-crack","ecosystem":"npm","purl":"pkg:npm/chai-as-crack"},"versions":["7.0.5"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"df4970a67c9caae5dd2e4603ea726f7624a4c17bb197a1039985a10ff9b56923","tlsh":"f016818d5685d42381cc2793be057ae9b17ae96684cca447ff74bf1c69bc41bc2a0ed0","path":"lib/config.js"},{"tlsh":"1c017b20dab85e6304ed25524c2a06437a654c575528fd1932eb612c4f9d5fb01bf21d","path":"package.json","sha256":"d1b1c09d633d667e3a50a0aab253dddf27cdba087e19c76594d3830e9a957db1"}],"package_integrity":[{"filename":"chai-as-crack-7.0.5.tgz","hashes":{"sha512_sri":"sha512-BFdyXLVWMCEwYo3VBTASRmMSPVXUfYAu8vNttxYXYdkgIMCcfVO9hIwKZ2HAy5uk321ziowPagni55IgzvMOMg==","sha1":"629a2d74299d234004a72f0db419b2e89db7592e"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-crack/MAL-2026-16196.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}