chai-as-mno

{"modified":"2026-08-24T16:46:38Z","published":"2026-08-24T16:46:38Z","schema_version":"1.7.4","id":"MAL-2026-14427","summary":"Malicious code in chai-as-mno (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2e94e194f078c230d6c6b15efcddc54b133fd52c890a55b0f8bdb4c680452381)\nThe package name mimics `chai-as-promised` and its README, badges, and license text are copied from an unrelated project (`pino`), while the package.json description is unrelated boilerplate. The declared main `index.js` exports a trivial no-op Express middleware `(_req,_res,next)=>next()` and unconditionally executes `require('./lib/config')` at import time. `lib/config.js` is a ~4MB single-line file heavily obfuscated with an obfuscator.io string-array scheme (string array `d` of length 23971 with rotation, hex-named identifiers, nested decoder functions `j`/`T`, control-flow flattening, and ~40,000 inline-decoded strings). The visible surface API provides no legitimate reason to ship a multi-megabyte opaque blob as a `config` module, and merely requiring the package runs that payload in the installer's Node process. The combination of impersonation cover story, mismatched README/description, no-op public API, and an obfuscator.io-grade payload executed on `require` is the loader/dropper shape.\n","affected":[{"package":{"ecosystem":"npm","name":"chai-as-mno"},"versions":["1.0.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"2f8c33b60aca4c86ba0782e243b8dad22450bc60d50af1f2ce3c71062119b745","tlsh":"1411009134d660cf8d3cdad0f2306515acdbc677260752b3befc9bc927860081161faa"},{"path":"lib/config.js","sha256":"f50f58b138120fab51de3d3d98fb96d24bd3cee998f3fcc27895344821910383","tlsh":"e4165f889645c93796ce17a3be0579ecf23aa9a194cca50b80bdbd5c39fc45bc0b0dd4"},{"path":"package.json","sha256":"7870b4c89425b2072483d4bd3bc99b92315c372fba71ca694c76474fcd27c936","tlsh":"93019c20cd789d2301dd21525c6a4642b3224d174928fd1833d7a12d4f9f9af01bf15c"}],"package_integrity":[{"filename":"chai-as-mno-1.0.5.tgz","hashes":{"sha1":"35b6b00a11c352da10054dc98a8529952b06dd5f","sha512_sri":"sha512-8C9+yWdeZRoFLe7Lfi1irW3sdPRrv1z8ZZLGq58jfvPWvHrtS5JmfM51QRUgfPLhE2rtbDO/Yzf1kEbqJHqqrA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-mno/v/1.0.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018654","import_time":"2026-08-24T16:49:15.227705107Z","modified_time":"2026-08-24T16:46:38Z","sha256":"2e94e194f078c230d6c6b15efcddc54b133fd52c890a55b0f8bdb4c680452381","source":"amazon-inspector","versions":["1.0.5"]}]}}