chain-async-dom

{"schema_version":"1.7.4","id":"MAL-2026-10082","published":"2026-07-09T17:02:16Z","modified":"2026-09-01T11:20:25.260914988Z","aliases":["GHSA-4r3j-x465-77rv"],"summary":"Malicious code in chain-async-dom (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (54cd392461a3d805dd24f6bc67d354498531f9b42352e8e0c17205351dcccf0b)\nThe package presents itself as a pino-compatible logger (lib/ directory mirrors pino's internal file layout — proto.js, levels.js, redaction.js, multistream.js, transport.js, tools.js, symbols.js, worker.js; keywords 'fast,logger,stream,json'; module.exports.pino alias) but its main entry index.js exports a middleware-style `check` function that, when invoked, spawns a detached `node lib/vcall.js` subprocess with `stdio:'inherit'` and `child.unref()` so the loader survives the parent process. lib/vcall.js retrieves JavaScript from a hardcoded IPFS gateway URL (https://emerald-accurate-urial-9.mypinata.cloud/ipfs/bafkreify2ijjvromekknzxzvqaopft6muwlpl37mvmpdeazwzzkbjzkuxm) via axios and executes the response body with `new Function.constructor('require', src)(require)` in a 5-retry loop, giving the fetched code full access to the consumer's Node runtime, filesystem, network, and environment. lib/const.js additionally ships a base64-encoded jsonkeeper paste URL (decodes to https://jsonkeeper.com/b/ZK45J) and a.env with DEV_API_CHECK_DOMAIN=http://vercel-five-coral.vercel.app/, staging additional mutable payload channels. The IPFS-served content is attacker-mutable and opaque; consumers who install and invoke this package as advertised (as a logger/middleware) receive arbitrary remote code execution.\n","affected":[{"package":{"name":"chain-async-dom","ecosystem":"npm"},"versions":["1.3.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/vcall.js","sha256":"d7e5e8df615ad740f90c6ea3cd9f7ab8f80ac996c4eb232c34ce0668d27e8139","tlsh":"7ef09e9f30fb205c577220fa560b45517002e16b7947e99b374cc3914f5985a2573f98"},{"path":"index.js","sha256":"a8a42982be73e18609aa4e0c0ff2a27e7fbdb6fed4b48a85daf9231ff667fcca","tlsh":"cef0ac4636f5a7a052249e85ea0be8363cc2c4357301edb082cef5d50743a6c86bb5d8"},{"path":"package.json","sha256":"d9df63e3148d17dd22c278004936914c066e924bd73a96b9844cd4d14012e28a","tlsh":"ad019c60ce788e2304ed25824c2e0643b6718c17a928fc2932db512d4f9e5bf45bf21d"},{"path":"lib/const.js","sha256":"9879ffb0bf61edef7e9b90ddc5fac9770c514c0cdecd9a07b15e8a677e6f8f74","tlsh":"8ac08c8351e4a89704301773610ca995f2a1d26f0c840b0331f594844a396a93840fbb"}],"package_integrity":[{"filename":"chain-async-dom-1.3.6.tgz","hashes":{"sha1":"a7198ea38268fd1104eb5baff96a794618eed96e","sha512_sri":"sha512-h9YSe4muyBrOqDVFmk5fSzt2h2Pbw/od8C3lvxygyWLtPYC7aXGcu2TjMKb3Pjys8zNgYfbmKg8vpTBKkttY2w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chain-async-dom/v/1.3.6"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-4r3j-x465-77rv"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009369","import_time":"2026-07-09T17:19:30.05808583Z","modified_time":"2026-07-09T17:02:16Z","sha256":"54cd392461a3d805dd24f6bc67d354498531f9b42352e8e0c17205351dcccf0b","source":"amazon-inspector","versions":["1.3.6"]},{"id":"RLMA-2026-06145","import_time":"2026-09-01T11:17:28.907715904Z","modified_time":"2026-08-24T16:44:00Z","sha256":"3a0005df7fc37f7d0ae5e321fce096063d4f8374fd3ab6a01680046da5e8b598","source":"reversing-labs","versions":["1.3.6"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}