chai-as-sleek

{"modified":"2026-09-09T06:49:23Z","published":"2026-09-09T06:49:23Z","schema_version":"1.7.4","id":"MAL-2026-16077","summary":"Malicious code in chai-as-sleek (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (782914cb65e0d30697eb54f50a4c5b740a3a53941abc185759e296c1d2ec8e9e)\nPackage published as 'chai-as-sleek' impersonates the pino logger: README, LICENSE, docs/, and index.d.ts are copied verbatim from pino, while package.json description reads 'This document describes the management of vulnerabilities...' and the README also markets the package as a chai plugin. The main entrypoint index.js unconditionally executes `require('./lib/config')` at load time. lib/config.js is a single ~4 MB line of obfuscator.io-obfuscated JavaScript (23,868-entry rotated string array, decoder functions T and j, control-flow flattening, ~20k decoder-wrapper calls) with no configuration content. package.json declares `axios ^1.10.0` as a runtime dependency, but no readable source file imports axios — the only reachable consumer of the HTTP client is the opaque blob in lib/config.js. Any consumer that imports 'chai-as-sleek' executes this hidden payload at require() time with outbound HTTP capability provisioned.\n","affected":[{"package":{"ecosystem":"npm","name":"chai-as-sleek"},"versions":["7.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/config.js","sha256":"df4970a67c9caae5dd2e4603ea726f7624a4c17bb197a1039985a10ff9b56923","tlsh":"f016818d5685d42381cc2793be057ae9b17ae96684cca447ff74bf1c69bc41bc2a0ed0"},{"path":"package.json","sha256":"cbe9ebb8aa8e34a0ba93790ce750f864c3cf9854bd7d1deabd8a982d8c924a28","tlsh":"c6017b20da785e2304ed25425c2a0603b6614c579528fd1932dba12c4f9d5fb01bf21d"}],"package_integrity":[{"filename":"chai-as-sleek-7.1.2.tgz","hashes":{"sha1":"bc2bf2596e535cb196e1632b0e18e826ebf42f84","sha512_sri":"sha512-ODrLagHQLbSHHqYBdtn3ckGXGFT+2EwmXyAC5GZWO3EoUQPQ8MWXEVeABCEhY507IIejmLq/choSvz59BX+2uw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-sleek/v/7.1.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019847","import_time":"2026-09-09T06:54:01.295527278Z","modified_time":"2026-09-09T06:49:23Z","sha256":"782914cb65e0d30697eb54f50a4c5b740a3a53941abc185759e296c1d2ec8e9e","source":"amazon-inspector","versions":["7.1.2"]}]}}