MAL-2026-13702
Dashboard / Malicious Package / MAL-2026-13702
MAL-2026-13702
Summary: Malicious code in chai-as-map (npm)
Details: Source: amazon-inspector (d3e93684202a75938b3139b209943cf55c34ea8ff9a215a6ead907e36d8ab953) The package presents itself as a chai-related utility (name `chai-as-map`, keywords `logger`/`stream`/`json`, description referencing vulnerability management) and bundles verbatim pino logger source under lib/ (proto.js, levels.js, redaction.js, docs/pino.md, LICENSE crediting pinojs), while the exported API in index.js is only a no-op Express middleware. index.js requires./lib/config on module load, and lib/config.js is a 4,083,409-byte obfuscator.io-style hex string array (~23,953 entries) with rotated decoders and control-flow flattening, containing no readable code. Loading the package therefore executes an opaque 4MB blob at import time. package.json also declares axios ^1.10.0 as a runtime dependency despite the advertised middleware performing no network I/O, aligning the module graph with a loader that reconstructs a remote destination from the obfuscated strings at runtime. The combination of typosquat naming, cover-story pino contents, an unrelated no-op public API, and a large obfuscated payload auto-executed on require is the shape of a stealer/loader delivered through name confusion.
Affected packages
Package
Name: chai-as-map
Purl: pkg:npm/chai-as-map
Affected ranges
Type: N/A
Events:
