chai-as-testkit

{"modified":"2026-08-23T03:14:40Z","published":"2026-08-23T03:14:40Z","schema_version":"1.7.4","id":"MAL-2026-14371","summary":"Malicious code in chai-as-testkit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0bf8ab4a811449bd1ba40c637a0eebc0569994d3a3550cf7156c36192abcec31)\nThe package is published as 'chai-as-testkit' with a description referencing vulnerability management, but the tarball ships pino's README, docs/, index.d.ts, and lib/ tree (proto, levels, transport, worker, redaction) under an unrelated author (Robert King <hello@jsonspack.com>, bugs.url jsonspack.com) rather than the real pinojs publisher. The shipped index.js is a synthetic stub whose only effect is `const config = require('./lib/config')`, and lib/config.js is a 4,083,409-byte single-line obfuscator.io-style bundle: a rotated hex-escaped string array of ~23,953 entries with control-flow flattening and dead-code layers (webcrack inlines 40,105 decoded strings across the decoder layers before failing to serialize). This blob runs immediately when any consumer imports the package, executing attacker-controlled code inside the developer or CI Node.js process. The pino impersonation is the social-engineering wrapper around an on-import loader; the shape (name/description/author mismatch + hollow main entry that delegates to a multi-megabyte obfuscated module at require time) is a typosquat-delivered install/import-time RCE vehicle rather than a logging library.\n","affected":[{"package":{"ecosystem":"npm","name":"chai-as-testkit"},"versions":["2.3.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/config.js","sha256":"ef7a5abedd9be15b8f63cd56aca72913f2858678bcd4148b96030b304e7ca5e4","tlsh":"861672889581c43395ce16a3ff2d6ae8f13a79f1c4c8a54bc569bc9c2dac91fd1a0dd0"},{"path":"package.json","sha256":"9d9df1481c920ec1d01c8cead724dd2ed789c26a411fabee68cd33a6f4414219","tlsh":"51017b20debc4e2301ed25524c2a0643ba614c175628fd1932db512d0f9d5ff41bf21d"}],"package_integrity":[{"filename":"chai-as-testkit-2.3.5.tgz","hashes":{"sha1":"3fde83408d21f4123e9127ed9dc0aaaf1f603dff","sha512_sri":"sha512-cBCciGdISfMyeKC4gwgCu2c9ciADdt+vwq/Wz56V9rL2Tnvx5Q2FNWk7jDLhGLGMxAdd6d+h3sRtqOMfBr9ghg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-testkit/v/2.3.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018569","import_time":"2026-08-23T03:25:56.212228176Z","modified_time":"2026-08-23T03:14:40Z","sha256":"0bf8ab4a811449bd1ba40c637a0eebc0569994d3a3550cf7156c36192abcec31","source":"amazon-inspector","versions":["2.3.5"]}]}}