MAL-2026-16380

    Dashboard / Malicious Package / MAL-2026-16380

    MAL-2026-16380

    Published: 22 Sept 2026Last Modified: 22 Sept 2026

    Summary: Malicious code in chai-logger (npm)

    Details: Source: amazon-inspector (566e54855d730e8555b93da4f8ea81faba72645079a7adcc3a05ea8bf8ad8ee6) The package presents itself as a Chai logging plugin but its main entry `index.js` requires `./lib/query.js`, a ~4 MB obfuscator.io-encoded module (23,868-entry rotated string array, T/j decoder wrappers, hex-property indirection) that executes at the top level as soon as the package is required. The remaining files under `lib/` (proto.js, levels.js, tools.js, etc.) are verbatim copies of pino source, unrelated to the advertised Chai plugin API — a cover story around the obfuscated blob. `package.json` declares `axios ^1.10.0` as a runtime dependency, and the only reference to axios in the shipped code is inside the obfuscated body of `lib/query.js`, giving the payload an HTTP client whose destination is reconstructed at runtime from the rotated string array. Author metadata points to `jsonspack.com`, unrelated to Chai or pino. The combination of import-time execution of a heavily obfuscated payload, a mismatched cover story, copied third-party source used as filler, and an HTTP client declared only for use inside the obfuscated code is the canonical npm credential/data-stealer shape.

    References: https://www.npmjs.com/package/chai-logger/v/3.0.2

    Affected packages

    Package

    Name: chai-logger

    Purl: pkg:npm/chai-logger

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.0.2