MAL-2026-10045

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-sharpened/MAL-2026-10045.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10045
Aliases
  • GHSA-wm45-4mwq-2pg6
Published
2026-07-09T15:31:55Z
Modified
2026-09-01T11:31:28Z
Summary
Malicious code in chai-as-sharpened (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (854e8e5d81ba59ee1353535523ea62b29c07de8d6a5cc50745a471696d80576a)

On require, the package spawns a detached background node process running lib/initializeCaller.js. That script base64-decodes a hardcoded URL (https://tomato-brunhilda-40.tiiny.site/index.json), fetches JSON from it, and executes the returned cookie field through new Function.constructor('require', response)(require) — giving the remote payload full require access on the installer's host. The endpoint URL and request header key/value are hidden inside base64 strings assigned to a locally-shadowed process.env object and decoded via atob() at runtime, obfuscating the C2 destination. The package additionally impersonates two well-known libraries: the name chai-as-sharpened mimics chai-as-promised, and the README badges/links point to pino and pinojs/pino, using name confusion as the delivery vector. Import triggers unconditional RCE against any consumer.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-009125",
            "import_time": "2026-07-09T16:20:43.156537114Z",
            "modified_time": "2026-07-09T15:31:55Z",
            "sha256": "854e8e5d81ba59ee1353535523ea62b29c07de8d6a5cc50745a471696d80576a",
            "source": "amazon-inspector",
            "versions": [
                "7.0.9"
            ]
        },
        {
            "id": "RLMA-2026-06127",
            "import_time": "2026-09-01T11:17:28.208060801Z",
            "modified_time": "2026-08-24T16:43:41Z",
            "sha256": "70ae7a33ba961df24040a7de3948bc0e708324d662e5026b1a01e7e5465d064c",
            "source": "reversing-labs",
            "versions": [
                "7.0.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / chai-as-sharpened

Package

Name
chai-as-sharpened
View open source insights on deps.dev
Purl
pkg:npm/chai-as-sharpened

Affected ranges

Affected versions

7.*
7.0.9

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/initializeCaller.js",
            "sha256": "23436f977c9bbe6d302f0f94e191b3dfd938e5a0417ec098d38b60b0ed0cb14f",
            "tlsh": "9511c08e61fc200c046512e6b62f18126021e8673d86d5e47acc835b1f9567f7d936df"
        },
        {
            "path": "README.md",
            "sha256": "90faf284e6a0900143752f8e2cf753e7cf78b44175911cb8472bfb7ff2c778f6",
            "tlsh": "7651976796e86fae5b6301b1a1c334b9ff1f931c7b6e506dec9c91381319997803114b"
        }
    ],
    "package_integrity": [
        {
            "filename": "chai-as-sharpened-7.0.9.tgz",
            "hashes": {
                "sha1": "214d67830292333e22d1eaa60e323622c64e46bc",
                "sha512_sri": "sha512-UIPAVVArb6L5GSr+Odvcp0TGvz4ZQCVXuk1Hc/GJwWZTb+yv6bhYTEp8q2zBWAzaK8Td52IJuuNR2ee26qG7Rw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-sharpened/MAL-2026-10045.json"