{"id":"MAL-2026-17189","summary":"Malicious code in chai-as-relay (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5c65319b0e17f945fc57f482eb174e5d7fe70e63a380cb24f64eea1808bdad2f)\nPackage main index.js unconditionally requires./lib/config at module load. lib/config.js is a single-line ~4.4MB obfuscator.io-packed IIFE (hex-escaped string-array of 26,102 entries, rotated with wrapper decoders, control-flow flattening, ~133k transform changes) that self-invokes at top level. Any consumer that `require('chai-as-relay')` executes this opaque bundle in-process. The remainder of the tarball (README, LICENSE, index.d.ts, lib/proto, etc.) is copied verbatim from the legitimate `pino` logger project, and index.js additionally exports a no-op Express-style middleware — the package's advertised identity is a cover for the dropper. The package.json name (`chai-as-relay`) and author (hello@jsonspack.com) have no relationship to pino or its maintainers. A heavily obfuscated, multi-megabyte, self-executing blob wired into the require entry of a package that impersonates a top-tier logger has no legitimate purpose and gives whoever controls the payload arbitrary code execution on every installer that imports the package.\n","modified":"2026-09-26T15:30:05.750373312Z","published":"2026-09-26T15:14:59Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020563","import_time":"2026-09-26T15:16:15.775157869Z","modified_time":"2026-09-26T15:14:59Z","sha256":"5c65319b0e17f945fc57f482eb174e5d7fe70e63a380cb24f64eea1808bdad2f","source":"amazon-inspector","versions":["1.2.1"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-relay/v/1.2.1"}],"affected":[{"package":{"name":"chai-as-relay","ecosystem":"npm","purl":"pkg:npm/chai-as-relay"},"versions":["1.2.1"],"database_specific":{"indicators":{"evidence_files":[{"path":"lib/config.js","sha256":"cc93ac7310b3a044badfc17f112a763bb24452ca88236892a470fdd362a9af36","tlsh":"8626a5c8494ae06389de26d37e0639d9e33b5d66d4eca5a7c66cbc9c6cbc447c0a1cd0"},{"path":"package.json","sha256":"37af31772ae215ad9ab85f2f37a7c46cbec4bb7b0a10ae13b7b4f19b84778a84","tlsh":"2a017620deb88e2300ed25924c2a0643ba714c479529fd2933dba12c4fad9bb01bf21d"}],"package_integrity":[{"hashes":{"sha1":"b78835bcec5b368ed0695706aa6eb15ab0c80a1b","sha512_sri":"sha512-Gzsi2w4ZEctlgEoQLU5pWM9oD/wKesHwq0uy3SC8wKcvJoLHFcvzvhtAAdQwqueChEII6ZTkaqQYE3XKY2h51Q=="},"filename":"chai-as-relay-1.2.1.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-relay/MAL-2026-17189.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}