MAL-2026-13701

    Dashboard / Malicious Package / MAL-2026-13701

    MAL-2026-13701

    Published: 10 Aug 2026Last Modified: 10 Aug 2026

    Summary: Malicious code in chai-as-format (npm)

    Details: Source: amazon-inspector (97806af0cd2e189771ef929999ea4b1812c7933b87dbaf2a2a9b7e6815bce36c) The package's index.js unconditionally requires./lib/config, which is a ~4MB single-line file consisting of an obfuscator.io-style hex-encoded string array (23,953 entries) with rotate/decoder functions and heavy control-flow flattening. This obfuscated code executes at every require('chai-as-format') on the installer's machine. The package presents itself under the name chai-as-format but its README, LICENSE, docs, and lib/* content are copied from the unrelated pino logging framework (LICENSE cites pinojs/pino), while the package.json description references vulnerability management — the cover story does not match the shipped content. A multi-megabyte opaque decoder auto-loaded on import is not a legitimate config module; the shape is a trojan loader hidden behind an impersonation shell.

    References: https://www.npmjs.com/package/chai-as-format/v/2.3.5

    Affected packages

    Package

    Name: chai-as-format

    Purl: pkg:npm/chai-as-format

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.3.5
    MAL-2026-13701 | CVE-DB