MAL-2026-10046
Dashboard / Malicious Package / MAL-2026-10046
MAL-2026-10046
Summary: Malicious code in chai-as-smart (npm)
Details: Source: amazon-inspector (bbeb8dc929ba80789f3386d489e22fc4efa5fa43b2901a4d6aa8524c03168a58) On require, index.js spawns lib/initializeCaller.js as a detached background process. That script decodes a base64-hidden URL (https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df), POSTs the caller's full process.env to that endpoint via axios, and then passes the HTTP response body into `new Function('require', response.data)` and immediately invokes it with the real `require`, giving the remote server arbitrary code execution inside the installer's Node.js process. The C2 URL and headers are stored as base64 inside fake object literals labeled DEV_API_KEY/DEV_SECRET_KEY, and the package name and package.json keywords (fast, logger, stream, json) masquerade as a pino-style logger middleware to lure installers into requiring it. The combined behavior — environment-variable exfiltration to a hardcoded attacker endpoint plus remote-fetched code execution with full require access — compromises any machine that installs or imports this package, exposing tokens, cloud credentials, and CI secrets and enabling full follow-on RCE.
Affected packages
Package
Name: chai-as-smart
Purl: pkg:npm/chai-as-smart
Affected ranges
Type: N/A
Events:
