MAL-2026-13446

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-chai/MAL-2026-13446.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13446
Published
2026-08-06T19:11:04Z
Modified
2026-08-06T23:50:14.427285498Z
Summary
Malicious code in express-chai (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (34482e23635422fb5ca5632e68708453f1c99317a31e5e8346c75c4d3466560f)

express-chai presents itself as an Express logger middleware impersonating pino, but its exported middleware factory invokes lib/caller.js which decodes a base64-obfuscated URL (https://gray-dyane-31.tiiny.site/index.json) stored in lib/const.js, fetches a JSON payload via axios with a base64-encoded dev-secret-key header, and passes the response's cookie field to new Function.constructor("require", s), then invokes the resulting function with the local require. This grants the operator of the anonymous tiiny.site host arbitrary code execution inside the installer's Node.js process at middleware setup time, with full access to require and the surrounding application context. The destination URL and secret header are base64-encoded rather than plain configuration, and the package's naming, keywords (fast, logger, stream, json), and pino-mirroring script names disguise a remote code loader as a well-known logging library.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "3.7.9"
            ],
            "id": "IN-MAL-2026-016744",
            "import_time": "2026-08-06T23:25:07.094269835Z",
            "modified_time": "2026-08-06T19:11:04Z",
            "source": "amazon-inspector",
            "sha256": "34482e23635422fb5ca5632e68708453f1c99317a31e5e8346c75c4d3466560f"
        }
    ]
}
References
Credits

Affected packages

npm / express-chai

Package

Name
express-chai
View open source insights on deps.dev
Purl
pkg:npm/express-chai

Affected ranges

Affected versions

3.*
3.7.9

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "express-chai-3.7.9.tgz",
            "hashes": {
                "sha512_sri": "sha512-J3A8e/IC0D3MuksmnYvOKLzYegus2NeQ8/ypH5Oo1IJsQFzE9/AXT0vez7TmsZ0v26NKUH4nnnKirT3yntj+4g==",
                "sha1": "34cc3aeed33a9fbf26e18258d30f649b3922d85e"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "lib/caller.js",
            "tlsh": "7df0784e31fd205c02a222e86b2b95336091f4623406d8c4374cc3535fe5aad5ba3ade",
            "sha256": "cb2c1b0cdf9cb22b28726542c4ce033d2ad9197bbc6294bb176051a3e42355c4"
        },
        {
            "path": "lib/const.js",
            "tlsh": "51d022d310a02440607013b2a61da901f582e8af0c8221183aea64840a366aa3880d6f",
            "sha256": "2d5b58230cd5bf2093cde8b7bf751fee8eee1d76acc4df2a8fb71796cf40dcf3"
        },
        {
            "path": "index.js",
            "tlsh": "dc111091b4f5514a064dd4d9b128a526bcf7d83732067db0aaec474927ce10c11b1bd3",
            "sha256": "96902515c575ebdf7adf510de5ad14e9df32eb6db930949dcf225a67318582be"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-chai/MAL-2026-13446.json"