MAL-2026-2894

    Dashboard / Malicious Package / MAL-2026-2894

    MAL-2026-2894

    Published: 15 Apr 2026Last Modified: 23 Apr 2026

    Summary: Malicious code in chai-as-nobj (npm)

    Details: chai-as-nobj is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint[.]io/5b357f718ab4ee355003 and executes it (similar to malware in to chai-await-test). Source: amazon-inspector (ffc87dd3744daacdd586689b29a0a1823015f765384619c5a79294b487cd7378) The package chai-as-nobj was found to contain malicious code.

    References: https://www.indece.com/en-US/blog/7df041ba-feb1-4d87-918b-7fc2c709d805

    Affected packages

    Package

    Name: chai-as-nobj

    Purl: pkg:npm/chai-as-nobj

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions