chai-as-map

{"modified":"2026-08-10T12:29:46Z","published":"2026-08-10T12:29:46Z","schema_version":"1.7.4","id":"MAL-2026-13702","summary":"Malicious code in chai-as-map (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d3e93684202a75938b3139b209943cf55c34ea8ff9a215a6ead907e36d8ab953)\nThe package presents itself as a chai-related utility (name `chai-as-map`, keywords `logger`/`stream`/`json`, description referencing vulnerability management) and bundles verbatim pino logger source under lib/ (proto.js, levels.js, redaction.js, docs/pino.md, LICENSE crediting pinojs), while the exported API in index.js is only a no-op Express middleware. index.js requires./lib/config on module load, and lib/config.js is a 4,083,409-byte obfuscator.io-style hex string array (~23,953 entries) with rotated decoders and control-flow flattening, containing no readable code. Loading the package therefore executes an opaque 4MB blob at import time. package.json also declares axios ^1.10.0 as a runtime dependency despite the advertised middleware performing no network I/O, aligning the module graph with a loader that reconstructs a remote destination from the obfuscated strings at runtime. The combination of typosquat naming, cover-story pino contents, an unrelated no-op public API, and a large obfuscated payload auto-executed on require is the shape of a stealer/loader delivered through name confusion.\n","affected":[{"package":{"ecosystem":"npm","name":"chai-as-map"},"versions":["2.3.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/config.js","sha256":"ef7a5abedd9be15b8f63cd56aca72913f2858678bcd4148b96030b304e7ca5e4","tlsh":"861672889581c43395ce16a3ff2d6ae8f13a79f1c4c8a54bc569bc9c2dac91fd1a0dd0"},{"path":"package.json","sha256":"28ed5d83943be14531f090a1723d6d3a5009c31330dad57f4630891ff258d89d","tlsh":"b2017b20da7c4e6300ed25524c2a06437a714c175628fd1932db512d0f9d5fb01ff21d"}],"package_integrity":[{"filename":"chai-as-map-2.3.5.tgz","hashes":{"sha1":"77098816eb5d8050bad476c9baa5008ca276e43c","sha512_sri":"sha512-3Tx707iJxcALwYzSVFxjdhBu6/jsQBU/D4PuKU4FBE30EESL+CFEro5wDmWOwTIQBqh80Ua/q4dmkaTNCY5KXw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-map/v/2.3.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017266","import_time":"2026-08-10T12:51:45.058228235Z","modified_time":"2026-08-10T12:29:46Z","sha256":"d3e93684202a75938b3139b209943cf55c34ea8ff9a215a6ead907e36d8ab953","source":"amazon-inspector","versions":["2.3.5"]}]}}