MAL-2026-10408

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chain-js-utils/MAL-2026-10408.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10408
Published
2026-07-13T06:49:21Z
Modified
2026-07-13T07:47:00.997170363Z
Summary
Malicious code in chain-js-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1a928356b1418a88bc30f460c42b1d9f3050ca3e67deb674307269a8c752d1d8)

The package impersonates pino (ships pino's docs and headers, exports a pino alias) but its actual runtime is an Express middleware factory in file.js that spawns a detached node lib/vcall.js child on each invocation. lib/vcall.js issues an HTTPS GET to https://api.jsonsilo.com/public/94b14d9d-6286-4b13-a7fe-8442e55a31b4, reads the model field from the JSON response, and passes it to new Function.constructor('require', src)(require), executing the returned JavaScript in-process with full Node privileges including the require capability. Retries up to five times. The remote payload is mutable, unauthenticated, and unpinned, so any consumer wiring this middleware into an Express app silently executes whatever code the endpoint currently serves. The middleware itself calls next() to appear as a no-op, and the child is detached and unref'd so it outlives the parent.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-009830",
            "sha256": "1a928356b1418a88bc30f460c42b1d9f3050ca3e67deb674307269a8c752d1d8",
            "modified_time": "2026-07-13T06:49:21Z",
            "import_time": "2026-07-13T07:40:11.639767141Z",
            "versions": [
                "2.1.1"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / chain-js-utils

Package

Name
chain-js-utils
View open source insights on deps.dev
Purl
pkg:npm/chain-js-utils

Affected ranges

Affected versions

2.*
2.1.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chain-js-utils/MAL-2026-10408.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "11c4069edef394345e2c982d398e47837c4f987ec576c1d61ef6e68d39862ec8",
            "tlsh": "64f0a31e31f62168597360f59b4f1112b103d5263a0aeed673cc43410fa946a3bb7bd0",
            "path": "lib/vcall.js"
        },
        {
            "sha256": "93db9d012b237a59580d646a46d3bc348d0796cbc8572ef4bcc020caf7cb5abe",
            "tlsh": "cee026da61f8b2942393a0fbf83712132471dc04300a4940cbfdcee21534820ab27db8",
            "path": "file.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "chain-js-utils-2.1.1.tgz",
            "hashes": {
                "sha1": "74a8d65f778983873ede0620003f1406bb585ed5",
                "sha512_sri": "sha512-xQqIuR7l9jfbzCnIMY6pyrmY0XVHKRUVjnEwVNJ7NIjz8PMRiLCqQPiIbA9ORVfzSkD/g0grTcyE44yA3w7FBQ=="
            }
        }
    ]
}