chai-as-smart

{"modified":"2026-07-09T15:28:07Z","published":"2026-07-09T15:28:07Z","schema_version":"1.7.4","id":"MAL-2026-10046","summary":"Malicious code in chai-as-smart (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bbeb8dc929ba80789f3386d489e22fc4efa5fa43b2901a4d6aa8524c03168a58)\nOn require, index.js spawns lib/initializeCaller.js as a detached background process. That script decodes a base64-hidden URL (https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df), POSTs the caller's full process.env to that endpoint via axios, and then passes the HTTP response body into `new Function('require', response.data)` and immediately invokes it with the real `require`, giving the remote server arbitrary code execution inside the installer's Node.js process. The C2 URL and headers are stored as base64 inside fake object literals labeled DEV_API_KEY/DEV_SECRET_KEY, and the package name and package.json keywords (fast, logger, stream, json) masquerade as a pino-style logger middleware to lure installers into requiring it. The combined behavior — environment-variable exfiltration to a hardcoded attacker endpoint plus remote-fetched code execution with full require access — compromises any machine that installs or imports this package, exposing tokens, cloud credentials, and CI secrets and enabling full follow-on RCE.\n","affected":[{"package":{"ecosystem":"npm","name":"chai-as-smart"},"versions":["2.3.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/initializeCaller.js","sha256":"fc61b0ed62e346bfbb5e1e093e475d8b3065247dc8d315f0ea4e7cafd9661bad","tlsh":"f921f38e15fe101d066751e6bb2f24027022e8133946d4a47bcc835b1fc966e99936df"},{"path":"package.json","sha256":"1f8ac9e39301b7f71b8a0ff19374bf8da3c833f808c0b53897025709930d1f83","tlsh":"a0019c60ce788e2300ed25824c2a064376618c136928fc2933d7512d0f9d4bf11bf21d"}],"package_integrity":[{"filename":"chai-as-smart-2.3.5.tgz","hashes":{"sha1":"4312436e13819e8da2007f134a23502c90febb8f","sha512_sri":"sha512-xvzE79zNCrwAsmCGjcuPE24yvFEnoz1mIpx7R1lWY6saDdo7DDHy/9DAslei+t7PQIiaKsnW7zwa8WLgyaE8uw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-smart/v/2.3.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009099","import_time":"2026-07-09T16:20:40.474706114Z","modified_time":"2026-07-09T15:28:07Z","sha256":"bbeb8dc929ba80789f3386d489e22fc4efa5fa43b2901a4d6aa8524c03168a58","source":"amazon-inspector","versions":["2.3.5"]}]}}