MAL-2026-13692

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-jsonss/MAL-2026-13692.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13692
Published
2026-08-10T11:56:07Z
Modified
2026-08-10T12:50:26.528501780Z
Summary
Malicious code in chai-jsonss (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3b1fff32102bc74783cae571646ec0fd68b14c614b35a63badd814a64caa3b67)

On import, index.js invokes postCallers() which resolves a base64-encoded URL stored in lib/const.js (decoding to https://1uznbx.s.gy/7xdQmt), GETs the response via axios, base64-decodes response.data.model, and passes it to new Function(require) — executing attacker-controlled JavaScript in-process. The destination is hidden as a DEVAPIKEY field on a fake process.env-shaped local module, and the payload URL is a shortlink to a mutable remote resource. The package name resembles chai but its main entry contains no chai-related functionality; the only import-time behavior is fetch-and-eval of remote code.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-10T12:24:46.199172734Z",
            "id": "IN-MAL-2026-017246",
            "sha256": "3b1fff32102bc74783cae571646ec0fd68b14c614b35a63badd814a64caa3b67",
            "modified_time": "2026-08-10T11:56:07Z",
            "source": "amazon-inspector",
            "versions": [
                "3.7.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / chai-jsonss

Package

Name
chai-jsonss
View open source insights on deps.dev
Purl
pkg:npm/chai-jsonss

Affected ranges

Affected versions

3.*
3.7.7

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/caller.js",
            "tlsh": "bbe0205f25f8205c157311ccb51688076187d0327141c0f275ec51961fc0f692291bd1",
            "sha256": "2db9b5dcbfbcf4fdf6c46042e0d5ea14324f29e0081fa8edd31d48c889e5baa2"
        },
        {
            "path": "lib/const.js",
            "tlsh": "49c08cc35094ac965071a233b24daa21f187d34f0c8100013ef0b8840a3a7ba3c84eab",
            "sha256": "f5940f8a2526599a6132503df100f8d3073b91b8aed775402a8542387c1d8089"
        }
    ],
    "package_integrity": [
        {
            "filename": "chai-jsonss-3.7.7.tgz",
            "hashes": {
                "sha1": "bf71a5b5274da00ab65c28e360f3c4420a4e0482",
                "sha512_sri": "sha512-DAnOczn/xIDDL5bqA4yFYpE9hx/QWxsoy+/ukXmRpl9Hbpvo7bnVo+t5zIKnn+H2mseBbmVkLWHk/5JjY5aKTQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-jsonss/MAL-2026-13692.json"