MAL-2026-10055

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chain-chai-async/MAL-2026-10055.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10055
Published
2026-07-09T15:33:49Z
Modified
2026-07-09T16:31:54.695386952Z
Summary
Malicious code in chain-chai-async (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (655c64cb99f74a3b96f1b5e1d0102ce0c756e63368a5ca252e70e49e98f346b3)

chain-chai-async@1.3.5 impersonates the pino logging library (README badge links to npm/pino, exports module.exports.pino = middleware, and ships files copied from the real pino source tree). Its exported middleware factory in index.js spawns lib/caller.js as a detached child node process with stdio ignored, decoupling the payload from the parent's lifecycle and suppressing its output. lib/caller.js issues an HTTPS GET to https://jsonkeeper.com/b/EXSIF, extracts the cookie field from the JSON response, and passes it to new Function.constructor('require', s)(require) — executing attacker-controlled JavaScript with full Node require access on any machine that loads and invokes the package. The remote source is a mutable, unauthenticated paste service, so the executed code can be swapped at any time by the attacker without republishing the package. Any consumer who installs this package believing it to be pino and calls its exported middleware will trigger arbitrary remote code execution on the host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "655c64cb99f74a3b96f1b5e1d0102ce0c756e63368a5ca252e70e49e98f346b3",
            "id": "IN-MAL-2026-009138",
            "import_time": "2026-07-09T16:20:44.54671087Z",
            "modified_time": "2026-07-09T15:33:49Z",
            "versions": [
                "1.3.5"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / chain-chai-async

Package

Name
chain-chai-async
View open source insights on deps.dev
Purl
pkg:npm/chain-chai-async

Affected ranges

Affected versions

1.*
1.3.5

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "c94c68398967a72596733d62b40d3b2df9490056a3b25bfd96333d0a88d84624",
            "tlsh": "e701cb8f30fd101c019122e66b1fe4327010e85b390ae4d4374c87521ffa5aeaa53ede",
            "path": "lib/caller.js"
        },
        {
            "sha256": "32e82853dd646aac388b78f868241267a5e6483d847df3d4c843f8100590d469",
            "tlsh": "30213f8175f111480658d9c8b569e5363ce3c4377207b9b0e9ecb7862bcf20c0272ad7",
            "path": "index.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "chain-chai-async-1.3.5.tgz",
            "hashes": {
                "sha512_sri": "sha512-AjE0DpL2L1NE6RXsP/I9/8RBcorELGLv+FuCe4VwbhK67kkLnEnCiExrAv/Hf+z5E0nk7S2kls9reRZ6epDMlg==",
                "sha1": "b8c2ce115ba0ca80b68d8115652ea60418a744c4"
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chain-chai-async/MAL-2026-10055.json"