{"id":"MAL-2026-6544","summary":"Malicious code in chai-as-persisted (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5cf9c49450e0fa0d47be1b6ae27991f844868ff6c435d2082948b5feae862709)\nThe package's postinstall script (`npm run smoke:pino`) executes index.js, which spawns a detached `node lib/initializeCaller.js` child. That module hides the C2 URL in base64 strings stored under a fabricated local `process.env` object (keys `DEV_API_KEY`, `DEV_SECRET_KEY`, `DEV_SECRET_VALUE`) to defeat trivial string scanning. At install time it `atob()`-decodes the URL to `https://www.ipregionchecker.org/api/ip-check-encrypted/3aeb34a37`, POSTs to it via axios, and passes the response body to `new Function.constructor('require', response)`, invoking it with `require` — executing attacker-controlled JavaScript with full Node module access on the installer's machine. The detached `child.unref()` keeps execution alive after `npm install` returns. The package name `chai-as-persisted` is a one-edit impersonation of the widely-used `chai-as-promised`; the shipped code is unrelated to chai (it pretends to be a pino-style logger middleware in index.js) and the package description/keywords (logger/stream/json) further misrepresent its purpose. This is a deliberate install-time RCE dropper distributed via a typosquat against chai-as-promised.\n","modified":"2026-06-27T03:31:39.039006939Z","published":"2026-06-27T02:32:25Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-06-27T02:32:37Z","import_time":"2026-06-27T03:13:09.022299524Z","source":"amazon-inspector","sha256":"5cf9c49450e0fa0d47be1b6ae27991f844868ff6c435d2082948b5feae862709","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"versions":["4.2.8"],"id":"IN-MAL-2026-007675"},{"modified_time":"2026-06-27T02:32:25Z","id":"IN-MAL-2026-007674","source":"amazon-inspector","sha256":"611d869aaf9d1a8b945c83cc9982fd76cd49a26563d444af3cee98ccb5b6fbda","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"versions":["6.1.9"],"import_time":"2026-06-27T03:13:08.872578262Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-persisted/v/4.2.8"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-persisted/v/6.1.9"}],"affected":[{"package":{"name":"chai-as-persisted","ecosystem":"npm","purl":"pkg:npm/chai-as-persisted"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["4.2.8","6.1.9"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-persisted/MAL-2026-6544.json","indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-OF+BlgV0u9rUuZYMvemtJ0jtoutqeNa8QgGbcduKIJEtdzrvqyHPkXKiBLwOBjOV6NQZL/j/0XmtVd9hDuBy+Q==","sha1":"f81cd3b1b4fa7eb57ab85af8d81f00ae94b10c89"},"filename":"chai-as-persisted-4.2.8.tgz"}],"evidence_files":[{"path":"lib/initializeCaller.js","sha256":"76ca537732f161ae4d3a78b876390ddbab16e001c392a74009b31fb91ce4f89b","tlsh":"4d119c4d71f82008042151e5b62f14126025e4673d8ad5e4bacc834b1fa667fbd53adf"},{"path":"package.json","sha256":"f061b9cb90a2c542ba90a73748290ff65dc070f811f75772bbfd0cc4453e0cbb","tlsh":"d0019720debc4e2305ed25860c2a06037a615c175528fc2833e7922c0f9d5bb00ff22e"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}