MAL-2026-2740

Dashboard / Malicious Package / MAL-2026-2740

MAL-2026-2740

Summary: Malicious code in chai-as-type (npm)

Details: chai-as-type is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint[.]io/c26313f0733957a7d787 and executes it (similar to malware in to chai-await-test). Source: amazon-inspector (75650bd9993ad4d310c42309ea4f185f9ec2bca169073315a9a1604c76830e41) The package name impersonates the popular chai / chai-as-promised assertion libraries, but the code is an unrelated pino-shaped middleware whose only side effect is launching a remote-code loader. lib/caller.js issues an axios GET to https://jsonkeeper.com/b/XRGF3 (an anonymous public JSON paste host), takes the returned `data.cookie` string, constructs `new Function.constructor('require', s)`, and invokes it with the live `require` — executing arbitrary attacker-controlled JavaScript in the installer's Node process with full module access. The C2 URL is base64-encoded and stashed under fake `DEV_API_KEY` / `DEV_SECRET_KEY` keys on a locally redeclared `process` object (`aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1hSR0Yz` decodes to the jsonkeeper URL); a sibling encoded URL `.../b/4NAKK` lives in lib/const.js. The loader is reached two ways: (1) when the exported `pino` middleware is invoked, index.js detaches a `child_process.spawn('node', ['lib/caller.js',...])`; (2) the package's `smoke:pino` npm script runs index.js directly. The paste-host content is mutable by the attacker at any time, so each fetch can deliver fresh payloads (credential theft, persistence, etc.) without re-publishing the package.

References: https://www.indece.com/en-US/blog/7df041ba-feb1-4d87-918b-7fc2c709d805, https://www.npmjs.com/package/chai-as-type/v/1.1.9, https://www.sonatype.com/blog/lazarus-groups-latest-brandjacking-campaign-on-npm, https://github.com/advisories/GHSA-38w3-8j54-936j