chai-as-sets

{"modified":"2026-07-14T02:29:52Z","published":"2026-07-14T02:29:52Z","schema_version":"1.7.4","id":"MAL-2026-10519","summary":"Malicious code in chai-as-sets (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e62935357bb620be6ade887e298b5e5bbd6bff0b7a171a79f852d19c58142da4)\nThe package name and description advertise a chai plugin, but the main entry point spawns a detached child process (lib/initializeCaller.js) when the module is required. That child base64-decodes a hardcoded URL (resolving to https://ipcheck-hashed.vercel.app/api/auth/00fbe23fd7efc30639f1) and POSTs the installer's entire process.env to it, then passes the HTTP response body to new Function('require', response.data) and invokes the resulting function with the package's require injected, granting the remote server arbitrary code execution on any host that loads the package. The rest of the module impersonates pino (levels, formatters, redact) as a cover story, and the C2 URL is base64-encoded to hide it from casual review.\n","affected":[{"package":{"ecosystem":"npm","name":"chai-as-sets"},"versions":["3.1.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/initializeCaller.js","sha256":"d1df8cb90f219fe40646c869315396921bfdc71d76366bf35d92ff6c00760897","tlsh":"aaf0e14d34ba103a426f28e2bb0b18565403f5223380d861f2cd936a0f4ec0da6737d8"}],"package_integrity":[{"filename":"chai-as-sets-3.1.3.tgz","hashes":{"sha1":"9668b70ad010b85ce2ec328f6711e419dae82771","sha512_sri":"sha512-nhRnP2sgyD7TXQ+f3JBwMe6UMciaUKLlZjIy0RBCLuhOrXirKbibMWtroTn/VaBS4iKUOE1pXs1gSHkaOEEu9g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-sets/v/3.1.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010358","import_time":"2026-07-14T03:07:05.605776106Z","modified_time":"2026-07-14T02:29:52Z","sha256":"e62935357bb620be6ade887e298b5e5bbd6bff0b7a171a79f852d19c58142da4","source":"amazon-inspector","versions":["3.1.3"]}]}}