MAL-2026-10630

    Dashboard / Malicious Package / MAL-2026-10630

    MAL-2026-10630

    Published: 15 Jul 2026Last Modified: 15 Jul 2026

    Summary: Malicious code in chai-as-byte (npm)

    Details: Source: amazon-inspector (a6820ba756fd8d2eb81435c478feb269e34f2aea859e42b42861d0a28f914a1f) On require of the package's main entry, index.js detaches a child process that runs lib/initializeCaller.js. That script posts the caller's entire process.env to a base64-obfuscated URL (decoded destination: https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df) using axios, then passes the response body to `new Function('require', response.data)` and invokes it with the module `require` — giving the remote endpoint arbitrary code execution on the installer's host with full module access. The package name mimics the chai-as-* family while its metadata advertises a JSON logger, and neither role is implemented in the shipped code; the main entry silently spawns the exfil/RCE task instead of exposing any library API. The bulk-environment upload captures CI secrets, cloud tokens, and API keys that live in process.env in typical build environments.

    References: https://www.npmjs.com/package/chai-as-byte/v/3.1.5, https://www.npmjs.com/package/chai-as-byte/v/3.1.6

    Affected packages

    Package

    Name: chai-as-byte

    Purl: pkg:npm/chai-as-byte

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.1.5
    3.1.6
    MAL-2026-10630 | CVE-DB