MAL-2026-12348

    Dashboard / Malicious Package / MAL-2026-12348

    MAL-2026-12348

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in chai-as-rendered (npm)

    Details: Source: amazon-inspector (545ba2341881e666831e81156a815fdfac738830ec2918167e4c5fd3c42294bf) Typosquat of chai-as-promised. The package's exported middleware spawns a detached child process (lib/caller.js) that fetches a JSON payload from a base64-obfuscated jsonstorage.net URL (https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f) and evaluates the returned.cookie string via new Function.constructor("require", s)(require), giving the fetched code full require access on the installer's host. The remote URL and request headers are stored as base64 strings under fake process.env names (DEV_API_KEY, DEV_SECRET_KEY, DEV_SECRET_VALUE) and decoded with atob() at runtime to conceal the destination. The package name and keywords (fast, logger, stream, json) impersonate pino while the package name typosquats chai-as-promised.

    References: https://www.npmjs.com/package/chai-as-rendered/v/1.2.0

    Affected packages

    Package

    Name: chai-as-rendered

    Purl: pkg:npm/chai-as-rendered

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.2.0
    MAL-2026-12348 | CVE-DB