MAL-2026-10202

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chain-await-dom/MAL-2026-10202.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10202
Published
2026-07-12T20:47:51Z
Modified
2026-07-12T21:01:54Z
Summary
Malicious code in chain-await-dom (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c7412987df7a746c9128ca807cbd2222b340e3b4f8397620348fc62606a0f2b5)

The package's declared main entry index.js exports a factory check() that spawns a detached, unreferenced Node child process running lib/vcall.js, then returns a noop Express-shaped middleware as cover. lib/vcall.js fetches JavaScript from https://api.jsonsilo.com/public/c6c0b393-932f-4ae1-8fca-23c6747f4acc (a mutable JSON-storage endpoint) and executes the response body via new Function.constructor('require', src)(require), with up to 5 retries. lib/constants.js also stores a base64-encoded secondary endpoint DEV_API_KEY decoding to https://jsonkeeper.com/b/ZK45J, consistent with fallback/staged remote-execution infrastructure. The module additionally re-exports the factory as module.exports.pino = check, mimicking the pino logger API, while the package name (chain-await-dom) and README describe unrelated functionality. Any consumer that requires this package triggers arbitrary remote code execution with full Node privileges; the detached+unref child process persists beyond the parent.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-009761",
            "import_time": "2026-07-12T20:48:33.832560255Z",
            "modified_time": "2026-07-12T20:47:51Z",
            "sha256": "c7412987df7a746c9128ca807cbd2222b340e3b4f8397620348fc62606a0f2b5",
            "source": "amazon-inspector",
            "versions": [
                "1.3.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / chain-await-dom

Package

Name
chain-await-dom
View open source insights on deps.dev
Purl
pkg:npm/chain-await-dom

Affected ranges

Affected versions

1.*
1.3.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/vcall.js",
            "sha256": "1b1079116bb2f4ec55dd8aeedf9c91f3060d178c9168b6b15f1ce0fba7ba6260",
            "tlsh": "aff0a35e30fb1469567220f5570f41217002e526392ad9d676cc53810f995662677ba4"
        },
        {
            "path": "index.js",
            "sha256": "a8a42982be73e18609aa4e0c0ff2a27e7fbdb6fed4b48a85daf9231ff667fcca",
            "tlsh": "cef0ac4636f5a7a052249e85ea0be8363cc2c4357301edb082cef5d50743a6c86bb5d8"
        },
        {
            "path": "lib/constants.js",
            "sha256": "f0be485061a3a8d768580035489ab78fd3e15bbe4a3d5000c8dba2336b11fa8b",
            "tlsh": "e2e02be278d87022ba4649f0943c458631528526740f7def01a70a4c0aed9813970ec5"
        }
    ],
    "package_integrity": [
        {
            "filename": "chain-await-dom-1.3.4.tgz",
            "hashes": {
                "sha1": "7d54f3748af153433b11789e19d9bedf4968e47a",
                "sha512_sri": "sha512-YBf/X3srghwJROPhJfkm15isxgDryzc2hpO2dvCElWmsL7/s9+54zhQa6p4t8b+PMWXzXn4d1b6IWjnSnkfnzg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chain-await-dom/MAL-2026-10202.json"