MAL-2026-10049

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-await-dom/MAL-2026-10049.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10049
Aliases
  • GHSA-5368-rr57-2vg7
Published
2026-07-09T15:34:20Z
Modified
2026-09-01T11:31:30Z
Summary
Malicious code in chai-await-dom (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e78d8b4da2e781df4437569123ba3913c3f0135bbef66addaa5766a109fdd98b)

The package impersonates a pino-style logger API but its exported middleware spawns a detached Node child process that runs lib/caller.js. caller.js retrieves a JavaScript payload from https://jsonkeeper.com/b/BPB86 (an anonymous paste-style host) and executes it in-process via new Function.constructor('require', s)(require), granting the remote host arbitrary code execution with the installer's Node privileges. lib/const.js stores a base64-encoded sibling URL (https://jsonkeeper.com/b/ZK45J decoded from aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1pLNDVK), deliberately obfuscating the C2 destination. The package name (chai-await-dom) does not match its actual behavior or its impersonated logger API surface, consistent with a namespace-abuse lure carrying a remote-code-execution payload.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-009141",
            "import_time":  "2026-07-09T16:20:44.915106032Z",
            "modified_time":  "2026-07-09T15:34:20Z",
            "sha256":  "e78d8b4da2e781df4437569123ba3913c3f0135bbef66addaa5766a109fdd98b",
            "source":  "amazon-inspector",
            "versions":  [
                "1.3.7"
            ]
        },
        {
            "id":  "RLMA-2026-06133",
            "import_time":  "2026-09-01T11:17:28.537820825Z",
            "modified_time":  "2026-08-24T16:43:44Z",
            "sha256":  "d2bbe277b40e8c1fa93ac4c7818407fc8a707287daa7cdae7bce3ac4268ed3c5",
            "source":  "reversing-labs",
            "versions":  [
                "1.3.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / chai-await-dom

Package

Name
chai-await-dom
View open source insights on deps.dev
Purl
pkg:npm/chai-await-dom

Affected ranges

Affected versions

1.*
1.3.7

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "lib/caller.js",
            "sha256":  "0eb54b2e747503e5eb4ef23794f55bd236c66a580bfec44e8c227fc3d7b6c73a",
            "tlsh":  "f601fe4e30fd201c42a120d55b1fa4327021e86b390ae4d5734cc7521fe656eae23fdd"
        },
        {
            "path":  "lib/const.js",
            "sha256":  "9879ffb0bf61edef7e9b90ddc5fac9770c514c0cdecd9a07b15e8a677e6f8f74",
            "tlsh":  "8ac08c8351e4a89704301773610ca995f2a1d26f0c840b0331f594844a396a93840fbb"
        },
        {
            "path":  "index.js",
            "sha256":  "32e82853dd646aac388b78f868241267a5e6483d847df3d4c843f8100590d469",
            "tlsh":  "30213f8175f111480658d9c8b569e5363ce3c4377207b9b0e9ecb7862bcf20c0272ad7"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "chai-await-dom-1.3.7.tgz",
            "hashes":  {
                "sha1":  "af909543f4befa2dbac1162b845d4c81add6d667",
                "sha512_sri":  "sha512-wpBlzO6vV66F2F+Uhl6itDPaJLcUv0qU48G/eO9pwHf2PUcZIarVpCnWOtuxnJ8pZHDWsOStzxFSPr870KIr4w=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-await-dom/MAL-2026-10049.json"