MAL-2026-10039

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-align/MAL-2026-10039.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10039
Aliases
  • GHSA-8vcr-xf6w-wg45
Published
2026-07-09T15:33:32Z
Modified
2026-09-01T11:30:50Z
Summary
Malicious code in chai-as-align (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (791f5dcd4f623d5301bc3abf922c5f0e4ff716017fe67d3673c778e9d31b0776)

The package presents itself as a testing/logging helper but its exported middleware factory spawns a detached background Node child that runs lib/initializeCaller.js. That script base64-decodes a hidden URL (https://amethyst-lorrin-26.tiiny.site/index.json) from a fake process.env stub, fetches its 'cookie' field over HTTPS with an 'x-secret-key' header, and executes the returned body via new Function.constructor('require', response) bound to the real require, in a retry loop. This yields full remote code execution on the installer's machine whenever the exported middleware is invoked. The destination is an anonymous file-hosting service (tiiny.site) whose contents are attacker-mutable. The package name closely resembles the popular chai-as-promised library, and its declared description/keywords do not match the shipped code, indicating typosquat delivery of the dropper. The detached+unref'd child with stdio ignored is used to hide the payload's activity from the consuming application.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-009136",
            "import_time": "2026-07-09T16:20:44.287628876Z",
            "modified_time": "2026-07-09T15:33:32Z",
            "sha256": "791f5dcd4f623d5301bc3abf922c5f0e4ff716017fe67d3673c778e9d31b0776",
            "source": "amazon-inspector",
            "versions": [
                "7.1.0"
            ]
        },
        {
            "id": "RLMA-2026-06107",
            "import_time": "2026-09-01T11:17:27.490409335Z",
            "modified_time": "2026-08-24T16:43:11Z",
            "sha256": "68e0cd5dd9417808ac7e6442656f3fd723ae6d94ad8666d473872abfbb3e099d",
            "source": "reversing-labs",
            "versions": [
                "7.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / chai-as-align

Package

Name
chai-as-align
View open source insights on deps.dev
Purl
pkg:npm/chai-as-align

Affected ranges

Affected versions

7.*
7.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/initializeCaller.js",
            "sha256": "2a41c6b7c5e256d70f884c613c6412ef73d86f8cd8a65afe6afb64fabaf4e022",
            "tlsh": "f111008d61fc200c056512e6b22f18116022e4273d4ad4e47adc83470f9627fbd536df"
        },
        {
            "path": "package.json",
            "sha256": "1d347da8cf0c0f7c8f3070a1bd311adb3a6ae9c9604be1d5a2296f3b10060828",
            "tlsh": "0e016860ce788e2304ed2582582a064376618c175928fc1932d7512c0f9d4bf05be21d"
        },
        {
            "path": "index.js",
            "sha256": "1f51184c197102444a2c8a23e4a8e54a6479750420512922fcb5d5f795c33911",
            "tlsh": "0f318545b5f21259126d98c4f6b4a5263cdf9437331b76b1cded93952bce2080032bc7"
        }
    ],
    "package_integrity": [
        {
            "filename": "chai-as-align-7.1.0.tgz",
            "hashes": {
                "sha1": "876e7d2c6ac31cec86a29b7c833b9d938466ae48",
                "sha512_sri": "sha512-EJ6J27HNFs/eID75yCGdKWBhgOL8pEKuK2ZPJLoLKtyyabZCbw4Cqlpd57jEdpoK1nlZ0pVKPqeNxNj7F429vg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-align/MAL-2026-10039.json"