chai-as-format

{"modified":"2026-08-10T12:31:52Z","published":"2026-08-10T12:31:52Z","schema_version":"1.7.4","id":"MAL-2026-13701","summary":"Malicious code in chai-as-format (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (97806af0cd2e189771ef929999ea4b1812c7933b87dbaf2a2a9b7e6815bce36c)\nThe package's index.js unconditionally requires./lib/config, which is a ~4MB single-line file consisting of an obfuscator.io-style hex-encoded string array (23,953 entries) with rotate/decoder functions and heavy control-flow flattening. This obfuscated code executes at every require('chai-as-format') on the installer's machine. The package presents itself under the name chai-as-format but its README, LICENSE, docs, and lib/* content are copied from the unrelated pino logging framework (LICENSE cites pinojs/pino), while the package.json description references vulnerability management — the cover story does not match the shipped content. A multi-megabyte opaque decoder auto-loaded on import is not a legitimate config module; the shape is a trojan loader hidden behind an impersonation shell.\n","affected":[{"package":{"ecosystem":"npm","name":"chai-as-format"},"versions":["2.3.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/config.js","sha256":"ef7a5abedd9be15b8f63cd56aca72913f2858678bcd4148b96030b304e7ca5e4","tlsh":"861672889581c43395ce16a3ff2d6ae8f13a79f1c4c8a54bc569bc9c2dac91fd1a0dd0"},{"path":"package.json","sha256":"7a4ac3a5e8465319a497f5e51330a71c9a71de00d345be1800df4beafff8a3de","tlsh":"da017b20da7c4e6304ed25524c2a06437a614c575528fd1932db512d0f9d5fb01bf21d"}],"package_integrity":[{"filename":"chai-as-format-2.3.5.tgz","hashes":{"sha1":"661f25746ae598c618bd1db13207f97f2dc4d3c4","sha512_sri":"sha512-YSsITYlrzPaHEEC22QhRIOKZg+ADBq3n80QU0xM5o5daQh3KAa+BdCG98mDEKiIeope8uUbw2tNmx01wcTfhOQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-format/v/2.3.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017271","import_time":"2026-08-10T12:51:45.301560773Z","modified_time":"2026-08-10T12:31:52Z","sha256":"97806af0cd2e189771ef929999ea4b1812c7933b87dbaf2a2a9b7e6815bce36c","source":"amazon-inspector","versions":["2.3.5"]}]}}