async-chain-dom

{"modified":"2026-07-13T06:49:36Z","published":"2026-07-13T06:49:36Z","schema_version":"1.7.4","id":"MAL-2026-10406","summary":"Malicious code in async-chain-dom (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0f2ce6eed4ea7607d2f12f602b43b354b91ceba4cabdc761f569c3e1dc29b6f6)\nOn require, index.js spawns a detached, unref'd `node lib/vcall.js` child process. lib/vcall.js fetches JavaScript from https://api.jsonsilo.com/public/df71fd55-4f0c-4326-9b5b-a285e38023a5, extracts the `.model` field from the response, and executes it via `new Function.constructor(\"require\", src)` with `require` passed in, giving the remote endpoint arbitrary code execution inside the installer's Node process. The detached+unref pattern decouples the loader from the parent lifecycle so it persists after the consumer process exits, and a retry loop keeps the fetch running. The package masquerades as the pino logger (module.exports.pino = vCheck; keywords fast/logger/stream/json; lib files mimicking pino) despite the name async-chain-dom, providing a cover story for a developer to require it. The remote endpoint is a mutable jsonsilo.com blob under attacker control, so the executed payload can be swapped at any time.\n","affected":[{"package":{"ecosystem":"npm","name":"async-chain-dom"},"versions":["1.3.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/vcall.js","sha256":"277f1492a353d0bea073792f7110ebdf3b266dcca9c6fe09979711e10cbc8498","tlsh":"e9f0a35f30fa20594a3760f5670f81216102d53a390eedda72cc43514fd946626b7bd0"},{"path":"index.js","sha256":"a5746f11a2fd192d52377570a8abcf99976464fb3da13acbb494a13c4ab0ed57","tlsh":"07f0ac4636f5a7a023249ec5fa0ae8372cc2c4317301ecb0d2ceb5e20743a6c86b74d8"},{"path":"package.json","sha256":"4847837b9dceab4063ebd703db1aaf493306602589af89e70d1470ebf6969b79","tlsh":"58f04460cc788e6305ec2596482a0242a6a19c176818fc2933d7611c4f9d5fb15be22e"}],"package_integrity":[{"filename":"async-chain-dom-1.3.5.tgz","hashes":{"sha1":"e3cbf849386d2f950a9964e079aad91f3d631e87","sha512_sri":"sha512-YTGt1yZcDVpHMTqWtUWmk1a24CtKl3MnUE7uqP9twE+7mRh4rUnP690J0wXPSxHCaVofK2aAB0P3Gt0Xbp6rzQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/async-chain-dom/v/1.3.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009831","import_time":"2026-07-13T07:40:11.724670518Z","modified_time":"2026-07-13T06:49:36Z","sha256":"0f2ce6eed4ea7607d2f12f602b43b354b91ceba4cabdc761f569c3e1dc29b6f6","source":"amazon-inspector","versions":["1.3.5"]}]}}