MAL-2026-10042

    Dashboard / Malicious Package / MAL-2026-10042

    MAL-2026-10042

    Published: 9 Jul 2026Last Modified: 9 Jul 2026

    Summary: Malicious code in chai-as-disarmed (npm)

    Details: Source: amazon-inspector (b6d396201a3dd1706d97f7daa880f254c920bbea65ea6b013ed48f78a21a0241) Package name typosquats `chai-as-promised` while the README and keywords impersonate `pino` to bait installs. On `require()`, index.js detach-spawns `lib/caller.js`, which decodes a base64-stored URL to `https://api.jsonstorage.net/v1/json/2ef8c758-.../a179ea35-...`, issues an authenticated GET (header name and value are also base64-hidden inside a local object that shadows `process.env`), and executes the returned `.cookie` string via `new Function.constructor('require', s)(require)` — granting the remote operator arbitrary code execution in the installer's Node.js process with full `require` access. The fetch retries up to 5 times. The remote content sits in a mutable third-party JSON store, so the executed payload can be swapped at any time without republishing the package. None of this behavior corresponds to the advertised chai/pino functionality.

    References: https://www.npmjs.com/package/chai-as-disarmed/v/3.2.3

    Affected packages

    Package

    Name: chai-as-disarmed

    Purl: pkg:npm/chai-as-disarmed

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.2.3
    MAL-2026-10042 | CVE-DB