MAL-2026-14201

Dashboard / Malicious Package / MAL-2026-14201

MAL-2026-14201

Summary: Malicious code in chaikit (npm)

Details: Source: amazon-inspector (a4711ba83393e8da11ab4368f9b38dac3de00bc523946cc27e4e47f38a51b9c4) The package's main entry (index.js) unconditionally requires./lib/config, a ~4MB obfuscator.io-style file (RC4 string-array decoder with ~23,902 entries, hex-encoded property names) whose top-level IIFE self-executes on load. Any consumer that imports chaikit runs this opaque code in their process. The advertised middleware in index.js is a trivial next() passthrough, so the obfuscated blob is the only substantive behavior of the package. package.json bundles axios as a runtime dependency, giving the opaque code a network egress channel. The README impersonates the pino logger (pino badges, pinojs/pino links, chai/chai-kit usage snippet), while the package.json description is unrelated boilerplate ('management of vulnerabilities') and file.js references a nonexistent./pino module — cover-story metadata consistent with a package published to be resolved by developers searching for chai or pino tooling. The combination of import-time execution of a large opaque blob, a mismatched cover story, and a bundled HTTP client is the canonical loader shape of an installer-harm supply-chain payload.

References: https://www.npmjs.com/package/chaikit/v/2.3.5