MAL-2026-5906
Dashboard / Malicious Package / MAL-2026-5906
MAL-2026-5906
Summary: Malicious code in chai-plugin-kit (npm)
Details: Source: amazon-inspector (26567b08d635c9b26d6befaba3dfc61a957bcf295cb321d03025b39bc54890ad) Package republishes the chai source tree under the confusable name `chai-plugin-kit`. The package's main entry (`index.js`) spawns a detached, stdio-silenced `node` subprocess running `lib/chai/utils/addAssertion.js` on every `require('chai-plugin-kit')`. That file is heavily obfuscated with obfuscator.io transforms (rotated 31-entry string array `_0x4a30`, custom base64 decoder `_0x495d`, hex-named identifiers, control-flow flattening) hiding an https GET to an attacker-controlled URL whose response body is passed to `new Function('require', body)` and immediately invoked with the real `require` — granting attacker-controlled JavaScript full Node API access (filesystem, network, child_process, env). The detached + unref + `stdio:'ignore'` pattern is deliberate evasion to hide the child process from the consuming developer. A legitimate chai plugin has no reason to fetch and eval remote code.
Affected packages
Package
Name: chai-plugin-kit
Purl: pkg:npm/chai-plugin-kit
Affected ranges
Type: N/A
Events:
