chain-chai-async

{"schema_version":"1.7.4","id":"MAL-2026-10055","published":"2026-07-09T15:33:49Z","modified":"2026-09-01T11:20:25.262586203Z","aliases":["GHSA-wqgh-vp7f-x5q6"],"summary":"Malicious code in chain-chai-async (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (655c64cb99f74a3b96f1b5e1d0102ce0c756e63368a5ca252e70e49e98f346b3)\nchain-chai-async@1.3.5 impersonates the pino logging library (README badge links to npm/pino, exports `module.exports.pino = middleware`, and ships files copied from the real pino source tree). Its exported middleware factory in index.js spawns lib/caller.js as a detached child node process with stdio ignored, decoupling the payload from the parent's lifecycle and suppressing its output. lib/caller.js issues an HTTPS GET to https://jsonkeeper.com/b/EXSIF, extracts the `cookie` field from the JSON response, and passes it to `new Function.constructor('require', s)(require)` — executing attacker-controlled JavaScript with full Node `require` access on any machine that loads and invokes the package. The remote source is a mutable, unauthenticated paste service, so the executed code can be swapped at any time by the attacker without republishing the package. Any consumer who installs this package believing it to be pino and calls its exported middleware will trigger arbitrary remote code execution on the host.\n","affected":[{"package":{"name":"chain-chai-async","ecosystem":"npm"},"versions":["1.3.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/caller.js","sha256":"c94c68398967a72596733d62b40d3b2df9490056a3b25bfd96333d0a88d84624","tlsh":"e701cb8f30fd101c019122e66b1fe4327010e85b390ae4d4374c87521ffa5aeaa53ede"},{"path":"index.js","sha256":"32e82853dd646aac388b78f868241267a5e6483d847df3d4c843f8100590d469","tlsh":"30213f8175f111480658d9c8b569e5363ce3c4377207b9b0e9ecb7862bcf20c0272ad7"}],"package_integrity":[{"filename":"chain-chai-async-1.3.5.tgz","hashes":{"sha1":"b8c2ce115ba0ca80b68d8115652ea60418a744c4","sha512_sri":"sha512-AjE0DpL2L1NE6RXsP/I9/8RBcorELGLv+FuCe4VwbhK67kkLnEnCiExrAv/Hf+z5E0nk7S2kls9reRZ6epDMlg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chain-chai-async/v/1.3.5"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wqgh-vp7f-x5q6"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009138","import_time":"2026-07-09T16:20:44.54671087Z","modified_time":"2026-07-09T15:33:49Z","sha256":"655c64cb99f74a3b96f1b5e1d0102ce0c756e63368a5ca252e70e49e98f346b3","source":"amazon-inspector","versions":["1.3.5"]},{"id":"RLMA-2026-06146","import_time":"2026-09-01T11:17:29.044116571Z","modified_time":"2026-08-24T16:44:11Z","sha256":"d362ca5481acb8f70ec16fb54794f6daf820eaf4a2bcffd78e4c8b623e5a710a","source":"reversing-labs","versions":["1.3.5"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}