MAL-2026-13699
Dashboard / Malicious Package / MAL-2026-13699
MAL-2026-13699
Summary: Malicious code in chai-as-bench (npm)
Details: Source: amazon-inspector (487af469d8de2a3caa5e798df3a5d56e59b795c1ddc106abd1d38ed855b6fb17) The package presents itself as a chai plugin (name resembles chai-as-promised, manifest description references chai assertions), but ships no chai-related functionality. index.js unconditionally loads lib/config.js on require(), and lib/config.js is a ~4 MB obfuscator.io payload with a 23,890-entry rotating string array, hex-obfuscated identifiers, and control-flow flattening. The remaining lib/ files (proto.js, multistream.js, transport.js) plus LICENSE are copied verbatim from the unrelated pino logger project as camouflage, and index.js itself only exports a no-op Express-style middleware ((_req,_res,next)=>next()). README contains placeholder yourusername GitHub URLs and generic author metadata ([email protected]). Heavy obfuscation of a multi-megabyte payload that runs on every require(), inside a package whose advertised purpose does not require any such code and whose surrounding files are stolen from an unrelated project, is the standard loader/stealer shape for an npm supply-chain plant targeting developers who mistype chai-as-promised.
Affected packages
Package
Name: chai-as-bench
Purl: pkg:npm/chai-as-bench
Affected ranges
Type: N/A
Events:
