chai-as-modified

{"schema_version":"1.7.4","id":"MAL-2026-10043","published":"2026-07-09T15:34:58Z","modified":"2026-09-01T11:20:25.213660125Z","aliases":["GHSA-mq6v-3fqr-9cp6"],"summary":"Malicious code in chai-as-modified (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ab841cd3ab01bfcd1257a214489b41f10e236779e236a0672642777160245a9e)\nPackage name is a 1-2 character variant of the widely-used `chai-as-promised` plugin. The exported function — the entry point users pass to `chai.use(...)` per the copied pino README — invokes a `runBackgroundTask` helper that spawns a detached `node` subprocess (`detached: true`, `stdio: 'ignore'`, `child.unref()`) running a sibling `./lib/initializeCaller.js`, then returns a no-op pass-through middleware. The detached, unref'd child is decoupled from the parent test runner and outlives it — an out-of-band execution channel that has no relationship to the advertised purpose of a chai assertion plugin. The `lib/` directory ships a verbatim copy of unrelated pino source as decoy content, and the README is copied from pinojs/pino. In this specific tarball the referenced `./lib/initializeCaller.js` file is not present, so the fork currently errors out, but the launcher stub, name-confusion vector, decoy content, and covert-execution mechanism are all in place; the missing payload is consistent with a staged release or intended delivery via a sibling/subsequent publish.\n","affected":[{"package":{"name":"chai-as-modified","ecosystem":"npm"},"versions":["6.0.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"1f51184c197102444a2c8a23e4a8e54a6479750420512922fcb5d5f795c33911","tlsh":"0f318545b5f21259126d98c4f6b4a5263cdf9437331b76b1cded93952bce2080032bc7"}],"package_integrity":[{"filename":"chai-as-modified-6.0.4.tgz","hashes":{"sha1":"55ab6b27cdb0e54c6a6546298dbed06e77f46c34","sha512_sri":"sha512-pZVE0B3+ZBcBLup07BG7RtfwDOw+T+zeX7zXpYyxXgdxdBq1ETOCqI6rLe1AcMLV2A47dL8QbsNv2/B4OfClmA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-modified/v/6.0.4"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mq6v-3fqr-9cp6"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009145","import_time":"2026-07-09T16:20:45.342198505Z","modified_time":"2026-07-09T15:34:58Z","sha256":"ab841cd3ab01bfcd1257a214489b41f10e236779e236a0672642777160245a9e","source":"amazon-inspector","versions":["6.0.4"]},{"id":"RLMA-2026-06120","import_time":"2026-09-01T11:17:27.810601895Z","modified_time":"2026-08-24T16:43:28Z","sha256":"06f9a0e0b21d9fffe3cff7076c5e5c19183f7430718e8f408669b5180669b797","source":"reversing-labs","versions":["6.0.4"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}