MAL-2026-10047

Dashboard / Malicious Package / MAL-2026-10047

MAL-2026-10047

Summary: Malicious code in chai-as-staged (npm)

Details: Source: amazon-inspector (84d908f9158abcdd631b569f812b06cb59a1788f2435dd05a47fd39021d60a49) Package name impersonates the popular `chai-as-promised` testing library and the README is copied from `pino`. The advertised usage `chai.use(chaiAsStaged)` triggers a detached `node` child process that runs `lib/initializeCaller.js`. That file hides its C2 endpoint and a custom HTTP header name/value as base64 strings stored under decoy names (`DEV_API_KEY`, `DEV_SECRET_KEY`, `DEV_SECRET_VALUE`) inside a fake local `process` object; at runtime it base64-decodes the URL to `https://amethyst-lorrin-26.tiiny.site/index.json`, fetches it with the obfuscated header, extracts the `.cookie` field from the JSON response, and executes the returned JavaScript via `new Function.constructor('require', response)(require)` in a retry loop. Attacker-controlled code is therefore executed on the installer's machine with full `require` access whenever the library is used as documented. The combination of name/README impersonation, base64-obfuscated C2 on an anonymous static-hosting host, and dynamic code construction with `require` removes any benign interpretation.

References: https://www.npmjs.com/package/chai-as-staged/v/6.0.4, https://github.com/advisories/GHSA-fchw-g3j3-hxh3