MAL-2026-5605
Dashboard / Malicious Package / MAL-2026-5605
MAL-2026-5605
Summary: Malicious code in chai-as-victimed (npm)
Details: Source: amazon-inspector (4b60cf728d4e2f5932f37d3e420649f6facc08959a8380a4724ec9e885b88754) Package name impersonates chai-as-promised but ships a remote-code dropper. lib/caller.js base64-decodes a hardcoded URL pointing to https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/a179ea35-b962-4722-b3f1-e28316d1a44a (an attacker-controlled mutable JSON store), issues a GET with a custom `x-secret-key: _` header, takes the response's `.cookie` field, and executes it via `new Function.constructor('require', s)(require)` — granting the fetched code full Node privileges and `require` access. The URL, header name, and header value are stored base64-encoded under fake keys (`DEV_API_KEY`, `DEV_SECRET_KEY`, `DEV_SECRET_VALUE`) on a shadow `process.env` object to evade string scans. index.js spawns `node lib/caller.js` detached from the package's default export, so any consumer that loads and invokes the advertised middleware triggers arbitrary remote code execution on the installer's machine, retried up to 5 times. The README/keywords cosplay a logger (pino) while the package name targets users looking for chai-as-promised — neither matches the actual behavior.
Affected packages
Package
Name: chai-as-victimed
Purl: pkg:npm/chai-as-victimed
Affected ranges
Type: N/A
Events:
