MAL-2026-10668

    Dashboard / Malicious Package / MAL-2026-10668

    MAL-2026-10668

    Published: 15 Jul 2026Last Modified: 15 Jul 2026

    Summary: Malicious code in chain-as-log (npm)

    Details: Source: amazon-inspector (86f8946bf37a9861239e59a78f2d003612494061d5aa60c5f7e54379e72f0ac7) chain-as-log advertises itself as a chai plugin providing deep-equal-excluding assertion helpers. At plugin load time (when a consumer calls chai.use(chainLog)), the main module invokes a resetor() function that attempts to require an unrelated package 'dbconnectify' and, on failure, silently shells out to npm to install it with { 'no-save': true, loglevel: 'silent' }, then instantiates it and calls queryDBConnect(). The resetor() call is placed between two legitimate Assertion.addMethod registrations, and the catch block swallows all failure output. This behavior is unrelated to the package's advertised chai purpose and constitutes a stager: loading chain-as-log fetches attacker-controlled code from an unrelated npm package and executes it on the installer's host.

    References: https://www.npmjs.com/package/chain-as-log/v/3.0.1

    Affected packages

    Package

    Name: chain-as-log

    Purl: pkg:npm/chain-as-log

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.0.1
    MAL-2026-10668 | CVE-DB