MAL-2026-10045

    Dashboard / Malicious Package / MAL-2026-10045

    MAL-2026-10045

    Published: 9 Jul 2026Last Modified: 1 Sept 2026Aliases: 
    GHSA-wm45-4mwq-2pg6

    Summary: Malicious code in chai-as-sharpened (npm)

    Details: Source: amazon-inspector (854e8e5d81ba59ee1353535523ea62b29c07de8d6a5cc50745a471696d80576a) On require, the package spawns a detached background `node` process running `lib/initializeCaller.js`. That script base64-decodes a hardcoded URL (https://tomato-brunhilda-40.tiiny.site/index.json), fetches JSON from it, and executes the returned `cookie` field through `new Function.constructor('require', response)(require)` — giving the remote payload full `require` access on the installer's host. The endpoint URL and request header key/value are hidden inside base64 strings assigned to a locally-shadowed `process.env` object and decoded via `atob()` at runtime, obfuscating the C2 destination. The package additionally impersonates two well-known libraries: the name `chai-as-sharpened` mimics `chai-as-promised`, and the README badges/links point to `pino` and `pinojs/pino`, using name confusion as the delivery vector. Import triggers unconditional RCE against any consumer.

    References: https://www.npmjs.com/package/chai-as-sharpened/v/7.0.9, https://github.com/advisories/GHSA-wm45-4mwq-2pg6

    Affected packages

    Package

    Name: chai-as-sharpened

    Purl: pkg:npm/chai-as-sharpened

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    7.0.9
    MAL-2026-10045 | CVE-DB