MAL-2026-13692

    Dashboard / Malicious Package / MAL-2026-13692

    MAL-2026-13692

    Published: 10 Aug 2026Last Modified: 10 Aug 2026

    Summary: Malicious code in chai-jsonss (npm)

    Details: Source: amazon-inspector (3b1fff32102bc74783cae571646ec0fd68b14c614b35a63badd814a64caa3b67) On import, index.js invokes postCallers() which resolves a base64-encoded URL stored in lib/const.js (decoding to https://1uznbx.s.gy/7xdQmt), GETs the response via axios, base64-decodes response.data.model, and passes it to new Function(require) — executing attacker-controlled JavaScript in-process. The destination is hidden as a DEV_API_KEY field on a fake process.env-shaped local module, and the payload URL is a shortlink to a mutable remote resource. The package name resembles chai but its main entry contains no chai-related functionality; the only import-time behavior is fetch-and-eval of remote code.

    References: https://www.npmjs.com/package/chai-jsonss/v/3.7.7

    Affected packages

    Package

    Name: chai-jsonss

    Purl: pkg:npm/chai-jsonss

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.7.7
    MAL-2026-13692 | CVE-DB