MAL-2026-10531

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chain-devkit/MAL-2026-10531.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10531
Published
2026-07-14T04:02:57Z
Modified
2026-07-14T04:47:00.502815704Z
Summary
Malicious code in chain-devkit (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (aabf751a767ad631ac38651254930d99c8ccb0feab8dc5c96b5d3ab243796ddc)

The postinstall script fetches YAML from https://chain-devkit.com/config with no version pin, hash, or signature check, then parses it with js-yaml 3.12.0's yaml.load, which honors!!js/function and!!js/regexp tags and constructs Function objects at parse time. The parsed object is written to chain.config.yaml and re-loaded at require() time via the same unsafe loader, giving whoever controls chain-devkit.com a live channel to inject arbitrary JavaScript Function objects into installer processes at every install and every require. Current index.js only reads scalar fields (chainId, rpcUrl, network), so code execution is not automatically triggered on today's config content, but the injected Function values persist in the on-disk config and would execute if any consumer or future package version invokes them. Publisher metadata is thin (atomicmail.io author email, fresh package with no history), and the destination host is controlled by the same anonymous publisher, so the fetch is effectively an attacker-controlled update channel bolted onto npm install.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-14T04:32:00.445701447Z",
            "source": "amazon-inspector",
            "modified_time": "2026-07-14T04:02:57Z",
            "sha256": "aabf751a767ad631ac38651254930d99c8ccb0feab8dc5c96b5d3ab243796ddc",
            "id": "IN-MAL-2026-010389",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / chain-devkit

Package

Name
chain-devkit
View open source insights on deps.dev
Purl
pkg:npm/chain-devkit

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chain-devkit/MAL-2026-10531.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "fc8ddd5cad4d428d375a11eece298a8d12d543f4cc9788ccdcf4a9d5da9cb995",
            "tlsh": "ea5154ab40fb521206a285899587e07b3e27d28b731add98369c6489cfdcc4dc2179fd",
            "path": "scripts/postinstall.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "chain-devkit-1.0.0.tgz",
            "hashes": {
                "sha1": "4a91cd6b3bb280f562373db1e7c9f679d277d278",
                "sha512_sri": "sha512-NIsOEY4DGYjzleOHTI14CpsrSwZfcYRJtzvw3KJmJijsPDvE0bWEqhtuVyRZAkXtcirxJUU0Nh92LLNvV5qh6Q=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]