{"id":"MAL-2026-2740","summary":"Malicious code in chai-as-type (npm)","details":"chai-as-type is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint[.]io/c26313f0733957a7d787 and executes it (similar to malware in to chai-await-test).\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (75650bd9993ad4d310c42309ea4f185f9ec2bca169073315a9a1604c76830e41)\nThe package name impersonates the popular chai / chai-as-promised assertion libraries, but the code is an unrelated pino-shaped middleware whose only side effect is launching a remote-code loader. lib/caller.js issues an axios GET to https://jsonkeeper.com/b/XRGF3 (an anonymous public JSON paste host), takes the returned `data.cookie` string, constructs `new Function.constructor('require', s)`, and invokes it with the live `require` — executing arbitrary attacker-controlled JavaScript in the installer's Node process with full module access. The C2 URL is base64-encoded and stashed under fake `DEV_API_KEY` / `DEV_SECRET_KEY` keys on a locally redeclared `process` object (`aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1hSR0Yz` decodes to the jsonkeeper URL); a sibling encoded URL `.../b/4NAKK` lives in lib/const.js. The loader is reached two ways: (1) when the exported `pino` middleware is invoked, index.js detaches a `child_process.spawn('node', ['lib/caller.js',...])`; (2) the package's `smoke:pino` npm script runs index.js directly. The paste-host content is mutable by the attacker at any time, so each fetch can deliver fresh payloads (credential theft, persistence, etc.) without re-publishing the package.\n","aliases":["GHSA-38w3-8j54-936j"],"modified":"2026-09-01T11:31:29.577311417Z","published":"2026-04-15T22:05:03Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-04-16T09:48:55Z","sha256":"ca8f85334ab437b20dd22839623379d7b662d0b6f8cce2b38e4c953196d4c48f","source":"reversing-labs","versions":["7.0.5"],"id":"RLMA-2026-01916","import_time":"2026-04-16T15:38:56.690919983Z"},{"import_time":"2026-04-23T20:49:08.983509368Z","modified_time":"2026-04-23T20:43:56Z","sha256":"c48e79ab60bf33822b131a30be07b07afee7fe9feed4439ac5f43988283001ac","source":"amazon-inspector","versions":["7.0.5"]},{"source":"amazon-inspector","versions":["1.1.9"],"id":"IN-MAL-2026-003904","import_time":"2026-05-26T05:51:33.048401302Z","modified_time":"2026-05-21T16:28:40Z","sha256":"75650bd9993ad4d310c42309ea4f185f9ec2bca169073315a9a1604c76830e41"},{"id":"RLUA-2026-05001","import_time":"2026-07-09T09:17:06.516642586Z","modified_time":"2026-07-07T12:43:35Z","sha256":"23b7a3bd70fe91ee116fd88d8755b2de97f305f5c5ce8d64f25ab9a59b08299b","source":"reversing-labs","versions":["1.1.9"]},{"modified_time":"2026-08-24T16:43:43Z","sha256":"7d81a1d9c328b80c30a2f8d2fdcef23999b2c5a9b4b8db7ccb0029e5f7adf2bf","source":"reversing-labs","id":"RLUA-2026-06131","import_time":"2026-09-01T11:17:59.677775717Z"}],"iocs":{"urls":["https://api.npoint.io/c26313f0733957a7d787"]}},"references":[{"type":"REPORT","url":"https://www.indece.com/en-US/blog/7df041ba-feb1-4d87-918b-7fc2c709d805"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-type/v/1.1.9"},{"type":"WEB","url":"https://www.sonatype.com/blog/lazarus-groups-latest-brandjacking-campaign-on-npm"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-38w3-8j54-936j"}],"affected":[{"package":{"name":"chai-as-type","ecosystem":"npm","purl":"pkg:npm/chai-as-type"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["7.0.5","1.1.9"],"database_specific":{"indicators":{"evidence_files":[{"path":"lib/caller.js","sha256":"d81e48769a830cd3384a4b8977ade12e5ab7583eb7cca84e7ab966d15871bd71","tlsh":"f8017b8a30fa605c015510f64b1fa4327011e4273c49e5c5378c87524fea9ae6963aed"},{"path":"package.json","sha256":"ee7f43af72a5000ba73b6cf630067707e9ad7269d6c17996abc13dbacfba49e0","tlsh":"09019761ce788e2300ed25824c2e0643ba719c079828fc2d32db512d4f9e9bf01bf21d"}],"package_integrity":[{"hashes":{"sha1":"77a8fb23496806bdd27676dc15995862109cdf44","sha512_sri":"sha512-mFlnECLksRgkNcSlHuWwRq0pGQ0n1t9a8B5i4FDXOtFfciSvCSVH5EC4QV1mT3GMln5cmZAGqSokVBknlTQ8/A=="},"filename":"chai-as-type-1.1.9.tgz"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-type/MAL-2026-2740.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"},{"name":"indece","contact":["https://indece.com"],"type":"FINDER"}]}