MAL-2026-10504

    Dashboard / Malicious Package / MAL-2026-10504

    MAL-2026-10504

    Published: 13 Jul 2026Last Modified: 13 Jul 2026

    Summary: Malicious code in chai-as-verified (npm)

    Details: Source: amazon-inspector (fece219fd09d83bc6a41135483cf3ce8cd2769c22e7776c22d0eb97d65852dd5) Package name typosquats chai-as-promised while its package.json advertises unrelated logger/vulnerability-management metadata. On require, index.js invokes a middleware() that spawns a detached `node` child process running lib/initializeCaller.js with stdio ignored and unref()'d. That child decodes a base64-hidden URL (https://tomato-brunhilda-40.tiiny.site/index.json) from a shadowed `process.env` object, fetches the JS response with a base64-decoded header name `x-secret-key`, and executes it via `new Function.constructor("require", response)(require)`, granting the remote payload full Node require access. The C2 URL, header name, and header value are stored as base64 to hide them from static analysis.

    References: https://www.npmjs.com/package/chai-as-verified/v/7.1.5

    Affected packages

    Package

    Name: chai-as-verified

    Purl: pkg:npm/chai-as-verified

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    7.1.5