MAL-2026-13942

    Dashboard / Malicious Package / MAL-2026-13942

    MAL-2026-13942

    Published: 13 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in chai-as-reformed (npm)

    Details: Source: amazon-inspector (ae73388f2a877d421e53b37bdd36496a8048149ffe2e64a975e87c705f8b0e45) The package impersonates chai-as-promised and copies its README from pino, but its exported middleware spawns a detached `node lib/caller.js` process. caller.js base64-decodes a hardcoded jsonstorage.net URL (concealed together with an `x-secret-key` header name/value as base64 literals in a synthetic `process.env` object decoded with `atob`), fetches the JSON response, and passes its `cookie` field to `new Function.constructor("require", s)(require)`, executing attacker-controlled JavaScript in the host Node.js process with access to `require`. The remote payload is mutable and can be changed by the operator of the storage URL at any time.

    References: https://www.npmjs.com/package/chai-as-reformed/v/1.2.0

    Affected packages

    Package

    Name: chai-as-reformed

    Purl: pkg:npm/chai-as-reformed

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.2.0