MAL-2026-16077

    Dashboard / Malicious Package / MAL-2026-16077

    MAL-2026-16077

    Published: 9 Sept 2026Last Modified: 9 Sept 2026

    Summary: Malicious code in chai-as-sleek (npm)

    Details: Source: amazon-inspector (782914cb65e0d30697eb54f50a4c5b740a3a53941abc185759e296c1d2ec8e9e) Package published as 'chai-as-sleek' impersonates the pino logger: README, LICENSE, docs/, and index.d.ts are copied verbatim from pino, while package.json description reads 'This document describes the management of vulnerabilities...' and the README also markets the package as a chai plugin. The main entrypoint index.js unconditionally executes `require('./lib/config')` at load time. lib/config.js is a single ~4 MB line of obfuscator.io-obfuscated JavaScript (23,868-entry rotated string array, decoder functions T and j, control-flow flattening, ~20k decoder-wrapper calls) with no configuration content. package.json declares `axios ^1.10.0` as a runtime dependency, but no readable source file imports axios — the only reachable consumer of the HTTP client is the opaque blob in lib/config.js. Any consumer that imports 'chai-as-sleek' executes this hidden payload at require() time with outbound HTTP capability provisioned.

    References: https://www.npmjs.com/package/chai-as-sleek/v/7.1.2

    Affected packages

    Package

    Name: chai-as-sleek

    Purl: pkg:npm/chai-as-sleek

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    7.1.2