chai-await-dom

{"schema_version":"1.7.4","id":"MAL-2026-10049","published":"2026-07-09T15:34:20Z","modified":"2026-09-01T11:20:25.236972532Z","aliases":["GHSA-5368-rr57-2vg7"],"summary":"Malicious code in chai-await-dom (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e78d8b4da2e781df4437569123ba3913c3f0135bbef66addaa5766a109fdd98b)\nThe package impersonates a pino-style logger API but its exported middleware spawns a detached Node child process that runs lib/caller.js. caller.js retrieves a JavaScript payload from https://jsonkeeper.com/b/BPB86 (an anonymous paste-style host) and executes it in-process via `new Function.constructor('require', s)(require)`, granting the remote host arbitrary code execution with the installer's Node privileges. lib/const.js stores a base64-encoded sibling URL (https://jsonkeeper.com/b/ZK45J decoded from `aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1pLNDVK`), deliberately obfuscating the C2 destination. The package name (chai-await-dom) does not match its actual behavior or its impersonated logger API surface, consistent with a namespace-abuse lure carrying a remote-code-execution payload.\n","affected":[{"package":{"name":"chai-await-dom","ecosystem":"npm"},"versions":["1.3.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/caller.js","sha256":"0eb54b2e747503e5eb4ef23794f55bd236c66a580bfec44e8c227fc3d7b6c73a","tlsh":"f601fe4e30fd201c42a120d55b1fa4327021e86b390ae4d5734cc7521fe656eae23fdd"},{"path":"lib/const.js","sha256":"9879ffb0bf61edef7e9b90ddc5fac9770c514c0cdecd9a07b15e8a677e6f8f74","tlsh":"8ac08c8351e4a89704301773610ca995f2a1d26f0c840b0331f594844a396a93840fbb"},{"path":"index.js","sha256":"32e82853dd646aac388b78f868241267a5e6483d847df3d4c843f8100590d469","tlsh":"30213f8175f111480658d9c8b569e5363ce3c4377207b9b0e9ecb7862bcf20c0272ad7"}],"package_integrity":[{"filename":"chai-await-dom-1.3.7.tgz","hashes":{"sha1":"af909543f4befa2dbac1162b845d4c81add6d667","sha512_sri":"sha512-wpBlzO6vV66F2F+Uhl6itDPaJLcUv0qU48G/eO9pwHf2PUcZIarVpCnWOtuxnJ8pZHDWsOStzxFSPr870KIr4w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-await-dom/v/1.3.7"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5368-rr57-2vg7"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009141","import_time":"2026-07-09T16:20:44.915106032Z","modified_time":"2026-07-09T15:34:20Z","sha256":"e78d8b4da2e781df4437569123ba3913c3f0135bbef66addaa5766a109fdd98b","source":"amazon-inspector","versions":["1.3.7"]},{"id":"RLMA-2026-06133","import_time":"2026-09-01T11:17:28.537820825Z","modified_time":"2026-08-24T16:43:44Z","sha256":"d2bbe277b40e8c1fa93ac4c7818407fc8a707287daa7cdae7bce3ac4268ed3c5","source":"reversing-labs","versions":["1.3.7"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}