MAL-2026-10056

Dashboard / Malicious Package / MAL-2026-10056

MAL-2026-10056

Summary: Malicious code in chain-chai-await (npm)

Details: Source: amazon-inspector (53dc585524bcc3e64a107006ba8c763591b071bb174c7acadd716b6e99ac1c34) The package presents itself as a pino-compatible logger (exports `pino`, mirrors pino's lib/ layout with proto.js/redaction.js/transport.js/multistream.js/levels.js/time.js/symbols.js, and copies pino's defaultOptions shape) but has no relationship to the real pino package. When a consumer requires the package and invokes the exported middleware factory, index.js spawns lib/caller.js as a detached Node subprocess. caller.js performs an axios GET to https://jsonkeeper.com/b/K80JD, reads the `cookie` field from the JSON response, and executes it via `new Function.constructor("require", s)(require)` — arbitrary remote code execution in the consumer's Node process with full access to `require`. The fetch is retried up to 5 times. lib/const.js additionally stores a base64-encoded backup endpoint (aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1pLNDVK → https://jsonkeeper.com/b/ZK45J) and base64-encoded header key/value (`x-secret-key`, `_`) used by the loader. The pino cover story, mirrored file layout, obfuscated backup URL, and remote-fetch-and-execute primitive against a public paste-like host are the fingerprint of a dropper disguised as a logging library.

References: https://www.npmjs.com/package/chain-chai-await/v/1.3.6, https://www.npmjs.com/package/chain-chai-await/v/1.3.7, https://www.npmjs.com/package/chain-chai-await/v/1.3.5, https://github.com/advisories/GHSA-v7w8-4wfr-cvwf