MAL-2026-10175

    Dashboard / Malicious Package / MAL-2026-10175

    MAL-2026-10175

    Published: 10 Jul 2026Last Modified: 10 Jul 2026

    Summary: Malicious code in chai-as-doc (npm)

    Details: Source: amazon-inspector (cecfd3091225b3667317dd9da8fd56c4f5e7fc675e17d52cda601898b3a50ec2) The package presents itself as pino-style logging middleware but on require() spawns a detached Node child that runs lib/initializeCaller.js. That script base64-decodes a hardcoded URL (stored as a fake DEV_API_KEY constant) resolving to https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df, POSTs the entire process.env object to it with an x-secret-header, and then passes the HTTP response body to `new Function("require", response.data)` and invokes it with the local require. This gives the remote host arbitrary code execution inside the installer's Node process with full environment/credential access. The base64 obfuscation of the endpoint, the disguised middleware cover story, and the name resembling chai/chai-as-promised are consistent with a typosquat supply-chain attack.

    References: https://www.npmjs.com/package/chai-as-doc/v/2.3.5

    Affected packages

    Package

    Name: chai-as-doc

    Purl: pkg:npm/chai-as-doc

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.3.5
    MAL-2026-10175 | CVE-DB