chai-as-synced

{"schema_version":"1.7.4","id":"MAL-2026-6497","published":"2026-06-26T02:51:34Z","modified":"2026-08-24T16:51:03.962715802Z","summary":"Malicious code in chai-as-synced (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (be17d22b28dc53ea46085190c1f5ff11ae16ce4b80539162d68c2ad2b224158e)\nchai-as-synced@7.0.9 impersonates the pino logger: it ships pino's README, LICENSE, docs/, index.d.ts and lib/ file layout (proto.js, levels.js, redaction.js, transport.js, worker.js, tools.js, multistream.js) with pino's keywords (`fast`,`logger`,`stream`,`json`), while package.json declares an unrelated name and author (Robert King <hello@jsonspack.com>, bugs URL https://jsonspack.com/issues) and a boilerplate description unrelated to logging. index.js unconditionally executes `require('./lib/config')` at module top level. lib/config.js is not pino's config module; it is a ~4MB single-line obfuscator.io bundle (rotated string array of ~23,868 entries, hex-escaped identifiers, control-flow flattening, nested decoder functions) that auto-runs the moment any consumer imports the package. The package also declares `axios ^1.10.0` as a runtime dependency although the visible wrapper (a no-op express middleware) has no HTTP use, positioning the hidden payload to perform network I/O at import. The combination of deceptive identity, hidden obfuscated payload, import-time auto-execution, and a bundled HTTP client is a covert-code-execution shape inconsistent with any legitimate logging library.\n","affected":[{"package":{"name":"chai-as-synced","ecosystem":"npm"},"versions":["6.0.3","7.0.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"3653595b1ec1c3c78d9489b77c5cc5f43370481807db71b2873d78cc1be56896","tlsh":"6e019c60ce788e2304ed25824c2a064376619c13a928fc1932db512c0f9d5bf05ff26d"},{"path":"lib/initializeCaller.js","sha256":"2a41c6b7c5e256d70f884c613c6412ef73d86f8cd8a65afe6afb64fabaf4e022","tlsh":"f111008d61fc200c056512e6b22f18116022e4273d4ad4e47adc83470f9627fbd536df"},{"path":"index.js","sha256":"1f51184c197102444a2c8a23e4a8e54a6479750420512922fcb5d5f795c33911","tlsh":"0f318545b5f21259126d98c4f6b4a5263cdf9437331b76b1cded93952bce2080032bc7"}],"package_integrity":[{"filename":"chai-as-synced-6.0.3.tgz","hashes":{"sha1":"23bd6fe3dd5432840fef212a69140478da55c017","sha512_sri":"sha512-+p9JYFO2tMYylZTW6b71Y9N5u5sGHtz31+ampp7X86TOfJtSJZ/L2yoIKc7u/VW2zzWmkQPNiXD0N3ENL6vtxQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-synced/v/6.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-synced/v/7.0.9"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007582","import_time":"2026-06-26T03:14:43.456153823Z","modified_time":"2026-06-26T02:51:34Z","sha256":"7bc0ee3e6a8341e046b84880f9faf0a4750f4a261a791b95d1267066d7828071","source":"amazon-inspector","versions":["6.0.3"]},{"id":"IN-MAL-2026-018633","import_time":"2026-08-24T16:49:13.730295019Z","modified_time":"2026-08-24T16:39:42Z","sha256":"be17d22b28dc53ea46085190c1f5ff11ae16ce4b80539162d68c2ad2b224158e","source":"amazon-inspector","versions":["7.0.9"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}