chai-as-reformed

{"modified":"2026-08-13T17:21:22Z","published":"2026-08-13T17:21:22Z","schema_version":"1.7.4","id":"MAL-2026-13942","summary":"Malicious code in chai-as-reformed (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ae73388f2a877d421e53b37bdd36496a8048149ffe2e64a975e87c705f8b0e45)\nThe package impersonates chai-as-promised and copies its README from pino, but its exported middleware spawns a detached `node lib/caller.js` process. caller.js base64-decodes a hardcoded jsonstorage.net URL (concealed together with an `x-secret-key` header name/value as base64 literals in a synthetic `process.env` object decoded with `atob`), fetches the JSON response, and passes its `cookie` field to `new Function.constructor(\"require\", s)(require)`, executing attacker-controlled JavaScript in the host Node.js process with access to `require`. The remote payload is mutable and can be changed by the operator of the storage URL at any time.\n","affected":[{"package":{"ecosystem":"npm","name":"chai-as-reformed"},"versions":["1.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/caller.js","sha256":"ffa61701ff61ebc0c6d64cf09f5bc37a74a91b03b716129b90271d758dc164b7","tlsh":"6e01efd934fd501c021111ea171fa032a010e4373882d6c8374cc7428fa66bd2e93aef"},{"path":"package.json","sha256":"48fca66f5f6f6d40d63602700d1c47d73b4b87c87749cd407d5360f3efd32b57","tlsh":"1601cb61ceb88e7300dd31824c2a0243b6618c939928fd2932d7522c0f9daff11bf21d"}],"package_integrity":[{"filename":"chai-as-reformed-1.2.0.tgz","hashes":{"sha1":"947b739a5f3ece43d4e56819e21eff2b28ce17ed","sha512_sri":"sha512-ZbT0Y8d2WXmWE/ywW+kdxYXXSWPjTbLSSf8UA7TiUrCykvYoRg15ZQ3MsntA1wP3ILTbdfji+t8MOcl2ZG9cDg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-reformed/v/1.2.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017655","import_time":"2026-08-13T17:24:46.14280158Z","modified_time":"2026-08-13T17:21:22Z","sha256":"ae73388f2a877d421e53b37bdd36496a8048149ffe2e64a975e87c705f8b0e45","source":"amazon-inspector","versions":["1.2.0"]}]}}