MAL-2026-12540

    Dashboard / Malicious Package / MAL-2026-12540

    MAL-2026-12540

    Published: 5 Aug 2026Last Modified: 1 Sept 2026

    Summary: Malicious code in chai-as-inspired (npm)

    Details: Source: amazon-inspector (bc4795830ed2849aaf2a6eaa488fbecc42a31c2d6d212fe34e635c16217e46ed) chai-as-inspired is a typosquat resembling chai/pino packages. Its middleware entrypoint (index.js) spawns a detached `node lib/caller.js` child on invocation. caller.js hides its network destination behind a fake `process.env` object whose values are base64 blobs; decoding yields the URL https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f and an `x-secret-key` header. The response's `cookie` field is passed to `new Function.constructor('require', s)(require)`, executing attacker-controlled JavaScript in a retry loop with the installer's `require` and full Node privileges. The remote content is hosted on a mutable, anonymous JSON-storage bucket and can be changed at any time by the operator. The base64 disguise of the endpoint and header keys, combined with the fetch-and-eval mechanism, establishes hostile intent.

    References: https://www.npmjs.com/package/chai-as-inspired/v/2.2.4

    Affected packages

    Package

    Name: chai-as-inspired

    Purl: pkg:npm/chai-as-inspired

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.2.4
    MAL-2026-12540 | CVE-DB