MAL-2026-10406

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/async-chain-dom/MAL-2026-10406.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10406
Published
2026-07-13T06:49:36Z
Modified
2026-07-13T07:47:00Z
Summary
Malicious code in async-chain-dom (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0f2ce6eed4ea7607d2f12f602b43b354b91ceba4cabdc761f569c3e1dc29b6f6)

On require, index.js spawns a detached, unref'd node lib/vcall.js child process. lib/vcall.js fetches JavaScript from https://api.jsonsilo.com/public/df71fd55-4f0c-4326-9b5b-a285e38023a5, extracts the .model field from the response, and executes it via new Function.constructor("require", src) with require passed in, giving the remote endpoint arbitrary code execution inside the installer's Node process. The detached+unref pattern decouples the loader from the parent lifecycle so it persists after the consumer process exits, and a retry loop keeps the fetch running. The package masquerades as the pino logger (module.exports.pino = vCheck; keywords fast/logger/stream/json; lib files mimicking pino) despite the name async-chain-dom, providing a cover story for a developer to require it. The remote endpoint is a mutable jsonsilo.com blob under attacker control, so the executed payload can be swapped at any time.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-009831",
            "import_time":  "2026-07-13T07:40:11.724670518Z",
            "modified_time":  "2026-07-13T06:49:36Z",
            "sha256":  "0f2ce6eed4ea7607d2f12f602b43b354b91ceba4cabdc761f569c3e1dc29b6f6",
            "source":  "amazon-inspector",
            "versions":  [
                "1.3.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / async-chain-dom

Package

Name
async-chain-dom
View open source insights on deps.dev
Purl
pkg:npm/async-chain-dom

Affected ranges

Affected versions

1.*
1.3.5

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "lib/vcall.js",
            "sha256":  "277f1492a353d0bea073792f7110ebdf3b266dcca9c6fe09979711e10cbc8498",
            "tlsh":  "e9f0a35f30fa20594a3760f5670f81216102d53a390eedda72cc43514fd946626b7bd0"
        },
        {
            "path":  "index.js",
            "sha256":  "a5746f11a2fd192d52377570a8abcf99976464fb3da13acbb494a13c4ab0ed57",
            "tlsh":  "07f0ac4636f5a7a023249ec5fa0ae8372cc2c4317301ecb0d2ceb5e20743a6c86b74d8"
        },
        {
            "path":  "package.json",
            "sha256":  "4847837b9dceab4063ebd703db1aaf493306602589af89e70d1470ebf6969b79",
            "tlsh":  "58f04460cc788e6305ec2596482a0242a6a19c176818fc2933d7611c4f9d5fb15be22e"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "async-chain-dom-1.3.5.tgz",
            "hashes":  {
                "sha1":  "e3cbf849386d2f950a9964e079aad91f3d631e87",
                "sha512_sri":  "sha512-YTGt1yZcDVpHMTqWtUWmk1a24CtKl3MnUE7uqP9twE+7mRh4rUnP690J0wXPSxHCaVofK2aAB0P3Gt0Xbp6rzQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/async-chain-dom/MAL-2026-10406.json"