MAL-2026-16196
Dashboard / Malicious Package / MAL-2026-16196
MAL-2026-16196
Summary: Malicious code in chai-as-crack (npm)
Details: Source: amazon-inspector (090c71f12df6d5441dce686e54fef42805f1afd6575d48bc0f6263dcf50b2f21) Package's main entry (index.js) unconditionally requires./lib/config at top level, causing the file to execute on any require('chai-as-crack'). lib/config.js is approximately 4 MB of obfuscator.io-transformed code: a rotating string array of ~23,868 entries with hex-escaped identifiers, multiple decoder wrappers (T, j), and control-flow flattening. The exported middleware is a no-op decoy. Package metadata further disguises the module as the popular pino logger: package.json declares name chai-as-crack with keywords logger/stream/json, while README.md, docs/, index.d.ts, and LICENSE are copied verbatim from pino (linking to github.com/pinojs/pino). Author metadata (Robert King <[email protected]>, bugs URL https://jsonspack.com/issues) is unrelated to pino. The combination of import-time execution of an opaque multi-megabyte payload, heavy obfuscation with no source map or build artifacts, and a cover-story impersonating an unrelated well-known logger matches the loader/dropper shape and gives the publisher arbitrary code execution inside any consumer that imports the package.
Affected packages
Package
Name: chai-as-crack
Purl: pkg:npm/chai-as-crack
Affected ranges
Type: N/A
Events:
