chai-as-buffered

{"schema_version":"1.7.4","id":"MAL-2026-10041","published":"2026-07-09T15:34:29Z","modified":"2026-09-18T02:26:46.421245975Z","aliases":["GHSA-jvvq-ph8p-7cc9"],"summary":"Malicious code in chai-as-buffered (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3d136202d96267459c4bf3aaaf6c903d7bd2c491901b61dcf2f391a4612f951a)\nchai-as-buffered@3.7.24 is a typosquat lure (name resembles chai-as-promised; README and module exports impersonate the pino logger) whose actual behavior is a remote-payload dropper. lib/caller.js shadows `process` with a local object whose `env` holds base64-encoded constants for the C2 URL, header name, and header value, hiding the destination from review and from env scanning. When the exported middleware is invoked (e.g., via `chai.use(...)` or `require('chai-as-buffered')` wiring through the pino-styled export), the package base64-decodes the hidden URL (https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/a179ea35-b962-4722-b3f1-e28316d1a44a), spawns a detached, stdio-ignored `node./lib/caller.js` child, fetches a JSON document from that mutable third-party blob, and passes the document's `cookie` field to `Function.constructor('require', s)` invoked with the live `require`. The fetched JavaScript executes with full `require` access on the installer's machine. The destination is an attacker-controlled mutable JSON store whose content can be changed at any time, giving the publisher arbitrary code execution against any environment that loads this package.\n","affected":[{"package":{"name":"chai-as-buffered","ecosystem":"npm"},"versions":["3.7.24","7.2.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/caller.js","sha256":"37e9dde0f35864e2ea8dcd4c8b5324ef50e3798195d04c30ba6938352af702db","tlsh":"1b01af9934fe541c015112e9171fa1326050e4673d86e6c83b4c87129fa667e6e93adf"},{"path":"README.md","sha256":"17cd229f31776e3ec9aa3b66bae74a12e284d34647115c09740b0644864b4c8a","tlsh":"6d51b5a786e86b6e4b6300b2a1c339b9ff5f931cbf29606ddcd8913903198d3803150a"}],"package_integrity":[{"filename":"chai-as-buffered-3.7.24.tgz","hashes":{"sha1":"831226e1498f40bb9a94dacb6dd367a20aa3a21f","sha512_sri":"sha512-LvN5wIMxskyIWrcxhcI1HXFMQtOooJlrZ9fAEcp/OWFQ+LQrxIMA0NBzlK6UMup/Jm/GOnQXnZtGVSQsZ9zQeg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-buffered/v/3.7.24"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jvvq-ph8p-7cc9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-buffered/v/7.2.5"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009142","import_time":"2026-07-09T16:20:44.991110418Z","modified_time":"2026-07-09T15:34:29Z","sha256":"3d136202d96267459c4bf3aaaf6c903d7bd2c491901b61dcf2f391a4612f951a","source":"amazon-inspector","versions":["3.7.24"]},{"id":"RLMA-2026-06109","import_time":"2026-09-01T11:17:27.578796326Z","modified_time":"2026-08-24T16:43:12Z","sha256":"92a37028060f47639987506210a75d53d3667edc6318ac978198b684a3026569","source":"reversing-labs","versions":["3.7.24"]},{"id":"IN-MAL-2026-020173","import_time":"2026-09-18T02:25:26.441739382Z","modified_time":"2026-09-18T02:10:29Z","sha256":"2ecb1884d7e298d84e41c17c2ba0c868bd59f470d0aaffc52287b178315f2fad","source":"amazon-inspector","versions":["7.2.5"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}