MAL-2026-13703

    Dashboard / Malicious Package / MAL-2026-13703

    MAL-2026-13703

    Published: 10 Aug 2026Last Modified: 10 Aug 2026

    Summary: Malicious code in chai-as-promised-plus (npm)

    Details: Source: amazon-inspector (be02bee1e19ad24ae6091f0793dc22af62e54030388bbdc7d1aa29b078ac17a5) The package name mimics the widely-used chai-as-promised assertion helper and reuses its README/description. lib/chai-as-promised-plus.js defines the legitimate plugin factory and then overwrites module.exports with require('./config/config'), so any consumer that imports the package loads lib/config/config.js. That file is a 3,546,568-byte single-line javascript-obfuscator.io bundle (rotated string array of length 20721, two decoder functions, control-flow-flattening dispatcher of the form while(!![]){try{...}catch(o){y.push(y.shift())}}, hex-keyed object literals). A test-assertion helper has no legitimate need to ship a multi-megabyte obfuscated blob that replaces its exports at load time; the concealed payload runs in the consumer's Node.js process on require, which is the standard shape of a typosquat supply-chain attack delivering attacker-controlled code to the installer.

    References: https://www.npmjs.com/package/chai-as-promised-plus/v/6.1.3

    Affected packages

    Package

    Name: chai-as-promised-plus

    Purl: pkg:npm/chai-as-promised-plus

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    6.1.3