MAL-2026-6994

    Dashboard / Malicious Package / MAL-2026-6994

    MAL-2026-6994

    Published: 8 Jul 2026Last Modified: 9 Jul 2026

    Summary: Malicious code in chai-presentation (npm)

    Details: Source: amazon-inspector (1d078bac337fe2c1b76c757c29d286fc750be585db65f30f5d696038c2ea0d3a) On require(), index.js issues an HTTPS GET to https://www.jsonkeeper.com/b/PC5CK and passes the response's `cookie` field to `new Function('require',...)`, immediately invoking it with the host's `require`. This gives whoever controls that jsonkeeper.com paste full Node.js execution privileges on the installer's machine the moment any consumer imports the package. A second staged loader is wired in parallel: index.js top-level spawns a detached, stdio-ignored Node child running lib/caller.js, which polls a URL built from config values and, on a 404 response, passes `error.response.data.token` to Function.constructor and executes it with `require`. lib/const.js additionally stores a base64 string under `DEV_API_KEY` that decodes to https://jsonkeeper.com/b/4NAKK — a second anonymous paste-host URL hidden from plain-string scanning. The package name presents as a chai plugin but the README describes an unrelated package (`chai-submission`), and declared dependencies (axios, request, sqlite3) are unrelated to chai assertions — an impersonation lure wrapping two import-time remote-eval channels.

    References: https://www.npmjs.com/package/chai-presentation/v/0.0.1, https://www.npmjs.com/package/chai-presentation/v/0.0.2, https://www.npmjs.com/package/chai-presentation/v/0.0.4, https://www.npmjs.com/package/chai-presentation/v/0.0.3

    Affected packages

    Package

    Name: chai-presentation

    Purl: pkg:npm/chai-presentation

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.1
    0.0.2
    0.0.4
    0.0.3
    MAL-2026-6994 | CVE-DB