MAL-2026-12348

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-rendered/MAL-2026-12348.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12348
Published
2026-08-05T12:59:03Z
Modified
2026-08-05T13:35:02.439863602Z
Summary
Malicious code in chai-as-rendered (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (545ba2341881e666831e81156a815fdfac738830ec2918167e4c5fd3c42294bf)

Typosquat of chai-as-promised. The package's exported middleware spawns a detached child process (lib/caller.js) that fetches a JSON payload from a base64-obfuscated jsonstorage.net URL (https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f) and evaluates the returned.cookie string via new Function.constructor("require", s)(require), giving the fetched code full require access on the installer's host. The remote URL and request headers are stored as base64 strings under fake process.env names (DEVAPIKEY, DEVSECRETKEY, DEVSECRETVALUE) and decoded with atob() at runtime to conceal the destination. The package name and keywords (fast, logger, stream, json) impersonate pino while the package name typosquats chai-as-promised.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T12:59:03Z",
            "sha256": "545ba2341881e666831e81156a815fdfac738830ec2918167e4c5fd3c42294bf",
            "import_time": "2026-08-05T13:08:50.007717349Z",
            "id": "IN-MAL-2026-014834",
            "versions": [
                "1.2.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / chai-as-rendered

Package

Name
chai-as-rendered
View open source insights on deps.dev
Purl
pkg:npm/chai-as-rendered

Affected ranges

Affected versions

1.*
1.2.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "chai-as-rendered-1.2.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-86s/uZXVv0i1Z2Ty1Uu2eR8ESjvwzF6ixTrhTBAsCDjkYH1Rc88L2tZfmsZvg6pZHuenOgg6GmsXdwKJIEZqqA==",
                "sha1": "9cb07e3ac4d77c8af3ce61f3887de233b0a42103"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "6e01efd934fd501c021111ea171fa032a010e4373882d6c8374cc7428fa66bd2e93aef",
            "sha256": "ffa61701ff61ebc0c6d64cf09f5bc37a74a91b03b716129b90271d758dc164b7",
            "path": "lib/caller.js"
        },
        {
            "tlsh": "0701c061ce749e7304dd21824c2a0643b6614c435528fd2933d7513d0f9d9bf01bf21d",
            "sha256": "dfe14ad52936fd66e0d9f597459091f41a9f3ba899010bbde7a22f212bc6cd9b",
            "path": "package.json"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-rendered/MAL-2026-12348.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]