MAL-2026-10041

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-buffered/MAL-2026-10041.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10041
Published
2026-07-09T15:34:29Z
Modified
2026-07-09T16:31:52.377977533Z
Summary
Malicious code in chai-as-buffered (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3d136202d96267459c4bf3aaaf6c903d7bd2c491901b61dcf2f391a4612f951a)

chai-as-buffered@3.7.24 is a typosquat lure (name resembles chai-as-promised; README and module exports impersonate the pino logger) whose actual behavior is a remote-payload dropper. lib/caller.js shadows process with a local object whose env holds base64-encoded constants for the C2 URL, header name, and header value, hiding the destination from review and from env scanning. When the exported middleware is invoked (e.g., via chai.use(...) or require('chai-as-buffered') wiring through the pino-styled export), the package base64-decodes the hidden URL (https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/a179ea35-b962-4722-b3f1-e28316d1a44a), spawns a detached, stdio-ignored node./lib/caller.js child, fetches a JSON document from that mutable third-party blob, and passes the document's cookie field to Function.constructor('require', s) invoked with the live require. The fetched JavaScript executes with full require access on the installer's machine. The destination is an attacker-controlled mutable JSON store whose content can be changed at any time, giving the publisher arbitrary code execution against any environment that loads this package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "3d136202d96267459c4bf3aaaf6c903d7bd2c491901b61dcf2f391a4612f951a",
            "modified_time": "2026-07-09T15:34:29Z",
            "versions": [
                "3.7.24"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-009142",
            "import_time": "2026-07-09T16:20:44.991110418Z"
        }
    ]
}
References
Credits

Affected packages

npm / chai-as-buffered

Package

Name
chai-as-buffered
View open source insights on deps.dev
Purl
pkg:npm/chai-as-buffered

Affected ranges

Affected versions

3.*
3.7.24

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "37e9dde0f35864e2ea8dcd4c8b5324ef50e3798195d04c30ba6938352af702db",
            "tlsh": "1b01af9934fe541c015112e9171fa1326050e4673d86e6c83b4c87129fa667e6e93adf",
            "path": "lib/caller.js"
        },
        {
            "sha256": "17cd229f31776e3ec9aa3b66bae74a12e284d34647115c09740b0644864b4c8a",
            "tlsh": "6d51b5a786e86b6e4b6300b2a1c339b9ff5f931cbf29606ddcd8913903198d3803150a",
            "path": "README.md"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-LvN5wIMxskyIWrcxhcI1HXFMQtOooJlrZ9fAEcp/OWFQ+LQrxIMA0NBzlK6UMup/Jm/GOnQXnZtGVSQsZ9zQeg==",
                "sha1": "831226e1498f40bb9a94dacb6dd367a20aa3a21f"
            },
            "filename": "chai-as-buffered-3.7.24.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-buffered/MAL-2026-10041.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]