chai-as-byte

{"modified":"2026-07-15T04:54:43Z","published":"2026-07-15T01:21:59Z","schema_version":"1.7.4","id":"MAL-2026-10630","summary":"Malicious code in chai-as-byte (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a6820ba756fd8d2eb81435c478feb269e34f2aea859e42b42861d0a28f914a1f)\nOn require of the package's main entry, index.js detaches a child process that runs lib/initializeCaller.js. That script posts the caller's entire process.env to a base64-obfuscated URL (decoded destination: https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df) using axios, then passes the response body to `new Function('require', response.data)` and invokes it with the module `require` — giving the remote endpoint arbitrary code execution on the installer's host with full module access. The package name mimics the chai-as-* family while its metadata advertises a JSON logger, and neither role is implemented in the shipped code; the main entry silently spawns the exfil/RCE task instead of exposing any library API. The bulk-environment upload captures CI secrets, cloud tokens, and API keys that live in process.env in typical build environments.\n","affected":[{"package":{"ecosystem":"npm","name":"chai-as-byte"},"versions":["3.1.5","3.1.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/initializeCaller.js","sha256":"0a22e7a21ac873219d858746d8b32c2e4ba926f598e05fd06a617c792e440f03","tlsh":"dff0e14d24ba2039426e58e2bf1b18461403f9223381d861f7cd936e0f8dc0dea636c8"},{"path":"package.json","sha256":"b49a51495f34bbea0e43a32fd52e668a119407d6ef5888f39bc0d0072e11f94f","tlsh":"30017620dab88e2300ed25924c2a0643ba664c179528fd2932dba12c4fad5fb01bf21d"}],"package_integrity":[{"filename":"chai-as-byte-3.1.5.tgz","hashes":{"sha1":"afe410ec66cf5e753c85deab9414d31c3f9e9306","sha512_sri":"sha512-Ubm7Hg9m7G6G0FWA3pLEwjUKOCoIXvruCEmO/HZqbP7ft+y0n/Ihy/WJ1FOUtLc0cOA1Id2hBFXHwC80PtABDg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-byte/v/3.1.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-byte/v/3.1.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010594","import_time":"2026-07-15T01:37:35.209111713Z","modified_time":"2026-07-15T01:21:59Z","sha256":"a6820ba756fd8d2eb81435c478feb269e34f2aea859e42b42861d0a28f914a1f","source":"amazon-inspector","versions":["3.1.5"]},{"id":"IN-MAL-2026-010595","import_time":"2026-07-15T03:07:36.015467239Z","modified_time":"2026-07-15T02:52:15Z","sha256":"a822ae725d0887baa11e83624e59f504c11659322a343230ac0cb66c8d5f5c4b","source":"amazon-inspector","versions":["3.1.6"]}]}}