MAL-2026-13356

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-foundry/MAL-2026-13356.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13356
Published
2026-08-05T16:37:52Z
Modified
2026-08-05T17:20:11.135790043Z
Summary
Malicious code in chai-foundry (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (94e40493af5310c6ee769911bff65e55538911ae3f286fba2a3474f9f8a38940)

chai-foundry@7.0.2 is a trojan package presenting itself as a chai plugin (README shows chai.use(chaiLeaf)) while its badges, documentation, and internal version metadata (lib/meta.js exports version 9.6.0) are copied from the pino logger. The package's main entry index.js immediately loads ./lib/config, a 3.5MB file that is heavily obfuscated with obfuscator.io-class transforms: a rotated string array of 20,855 entries, two runtime decoder functions, tens of thousands of decoder-wrapper indirections, and control-flow flattening (104,934 deobfuscation changes reported by webcrack). The file begins with a top-level IIFE, so its opaque body runs automatically the moment any consumer calls require('chai-foundry'). All destinations and string constants are reconstructed at runtime, so the payload's network endpoints and behaviors are hidden from static inspection. The combination of identity impersonation, mismatched metadata, and a multi-megabyte control-flow-flattened import-time loader in a package advertised as a small chai plugin is the canonical shape of a hostile npm dropper/stealer.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "47d799affc9421116994671c24da24cabadfb12a42d5b12ac54b2fce2aa1afe2",
            "modified_time": "2026-08-05T16:37:52Z",
            "id": "IN-MAL-2026-015827",
            "versions": [
                "7.0.3"
            ],
            "import_time": "2026-08-05T17:04:49.368060143Z",
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-015828",
            "modified_time": "2026-08-05T16:38:06Z",
            "sha256": "94e40493af5310c6ee769911bff65e55538911ae3f286fba2a3474f9f8a38940",
            "versions": [
                "7.0.2"
            ],
            "import_time": "2026-08-05T17:04:49.46756877Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / chai-foundry

Package

Name
chai-foundry
View open source insights on deps.dev
Purl
pkg:npm/chai-foundry

Affected ranges

Affected versions

7.*
7.0.2
7.0.3

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-98Lhn+hs8c34dV82aVYJYuuJJ6PcoUQpi3lJr9Zp156eSXA5YEHpt6lt+tRzhQemoxCbNvn49bWPVixqpXATmA==",
                "sha1": "16fad30993d42f54098d3873a08527f0e3057aaa"
            },
            "filename": "chai-foundry-7.0.3.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "4e6c4e61a7019ab0affe9c2d20e36701b330ec357be205930355bac1464f9316",
            "path": "index.js",
            "tlsh": "0421149124d560ce9938dac0f6306115acdbc677260752b3bdfc97c927860080161fba"
        },
        {
            "sha256": "8397643af68793d57aec3637e79324e9183d6f1168009cd0676432515e88c515",
            "path": "lib/config.js",
            "tlsh": "261652d88984d123d3de9b13fe14a9a8f1fa79a6d4cce40b86987d4d29fc847d4a0cd4"
        },
        {
            "sha256": "8f82750cc52cd72a3f3f941a3474b192a18cac0c56acdfbe35bfd6d8cf602d10",
            "path": "package.json",
            "tlsh": "c0019e24de789e2304fd25524c2a06037a614c175528fc2932db612c4f5d5ff41ff21d"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-foundry/MAL-2026-13356.json"