MAL-2026-10519

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-sets/MAL-2026-10519.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10519
Published
2026-07-14T02:29:52Z
Modified
2026-07-14T03:16:56.430811936Z
Summary
Malicious code in chai-as-sets (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e62935357bb620be6ade887e298b5e5bbd6bff0b7a171a79f852d19c58142da4)

The package name and description advertise a chai plugin, but the main entry point spawns a detached child process (lib/initializeCaller.js) when the module is required. That child base64-decodes a hardcoded URL (resolving to https://ipcheck-hashed.vercel.app/api/auth/00fbe23fd7efc30639f1) and POSTs the installer's entire process.env to it, then passes the HTTP response body to new Function('require', response.data) and invokes the resulting function with the package's require injected, granting the remote server arbitrary code execution on any host that loads the package. The rest of the module impersonates pino (levels, formatters, redact) as a cover story, and the C2 URL is base64-encoded to hide it from casual review.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "e62935357bb620be6ade887e298b5e5bbd6bff0b7a171a79f852d19c58142da4",
            "modified_time": "2026-07-14T02:29:52Z",
            "versions": [
                "3.1.3"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-010358",
            "import_time": "2026-07-14T03:07:05.605776106Z"
        }
    ]
}
References
Credits

Affected packages

npm / chai-as-sets

Package

Name
chai-as-sets
View open source insights on deps.dev
Purl
pkg:npm/chai-as-sets

Affected ranges

Affected versions

3.*
3.1.3

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "d1df8cb90f219fe40646c869315396921bfdc71d76366bf35d92ff6c00760897",
            "tlsh": "aaf0e14d34ba103a426f28e2bb0b18565403f5223380d861f2cd936a0f4ec0da6737d8",
            "path": "lib/initializeCaller.js"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-nhRnP2sgyD7TXQ+f3JBwMe6UMciaUKLlZjIy0RBCLuhOrXirKbibMWtroTn/VaBS4iKUOE1pXs1gSHkaOEEu9g==",
                "sha1": "9668b70ad010b85ce2ec328f6711e419dae82771"
            },
            "filename": "chai-as-sets-3.1.3.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-sets/MAL-2026-10519.json"