chai-as-crack

{"modified":"2026-09-15T16:32:24Z","published":"2026-09-15T16:32:24Z","schema_version":"1.7.4","id":"MAL-2026-16196","summary":"Malicious code in chai-as-crack (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (090c71f12df6d5441dce686e54fef42805f1afd6575d48bc0f6263dcf50b2f21)\nPackage's main entry (index.js) unconditionally requires./lib/config at top level, causing the file to execute on any require('chai-as-crack'). lib/config.js is approximately 4 MB of obfuscator.io-transformed code: a rotating string array of ~23,868 entries with hex-escaped identifiers, multiple decoder wrappers (T, j), and control-flow flattening. The exported middleware is a no-op decoy. Package metadata further disguises the module as the popular pino logger: package.json declares name chai-as-crack with keywords logger/stream/json, while README.md, docs/, index.d.ts, and LICENSE are copied verbatim from pino (linking to github.com/pinojs/pino). Author metadata (Robert King <hello@jsonspack.com>, bugs URL https://jsonspack.com/issues) is unrelated to pino. The combination of import-time execution of an opaque multi-megabyte payload, heavy obfuscation with no source map or build artifacts, and a cover-story impersonating an unrelated well-known logger matches the loader/dropper shape and gives the publisher arbitrary code execution inside any consumer that imports the package.\n","affected":[{"package":{"ecosystem":"npm","name":"chai-as-crack"},"versions":["7.0.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/config.js","sha256":"df4970a67c9caae5dd2e4603ea726f7624a4c17bb197a1039985a10ff9b56923","tlsh":"f016818d5685d42381cc2793be057ae9b17ae96684cca447ff74bf1c69bc41bc2a0ed0"},{"path":"package.json","sha256":"d1b1c09d633d667e3a50a0aab253dddf27cdba087e19c76594d3830e9a957db1","tlsh":"1c017b20dab85e6304ed25524c2a06437a654c575528fd1932eb612c4f9d5fb01bf21d"}],"package_integrity":[{"filename":"chai-as-crack-7.0.5.tgz","hashes":{"sha1":"629a2d74299d234004a72f0db419b2e89db7592e","sha512_sri":"sha512-BFdyXLVWMCEwYo3VBTASRmMSPVXUfYAu8vNttxYXYdkgIMCcfVO9hIwKZ2HAy5uk321ziowPagni55IgzvMOMg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-crack/v/7.0.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020071","import_time":"2026-09-15T16:41:58.23645445Z","modified_time":"2026-09-15T16:32:24Z","sha256":"090c71f12df6d5441dce686e54fef42805f1afd6575d48bc0f6263dcf50b2f21","source":"amazon-inspector","versions":["7.0.5"]}]}}