MAL-2026-13701

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-format/MAL-2026-13701.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13701
Published
2026-08-10T12:31:52Z
Modified
2026-08-10T13:05:04.958713239Z
Summary
Malicious code in chai-as-format (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (97806af0cd2e189771ef929999ea4b1812c7933b87dbaf2a2a9b7e6815bce36c)

The package's index.js unconditionally requires./lib/config, which is a ~4MB single-line file consisting of an obfuscator.io-style hex-encoded string array (23,953 entries) with rotate/decoder functions and heavy control-flow flattening. This obfuscated code executes at every require('chai-as-format') on the installer's machine. The package presents itself under the name chai-as-format but its README, LICENSE, docs, and lib/* content are copied from the unrelated pino logging framework (LICENSE cites pinojs/pino), while the package.json description references vulnerability management — the cover story does not match the shipped content. A multi-megabyte opaque decoder auto-loaded on import is not a legitimate config module; the shape is a trojan loader hidden behind an impersonation shell.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "2.3.5"
            ],
            "import_time": "2026-08-10T12:51:45.301560773Z",
            "modified_time": "2026-08-10T12:31:52Z",
            "id": "IN-MAL-2026-017271",
            "sha256": "97806af0cd2e189771ef929999ea4b1812c7933b87dbaf2a2a9b7e6815bce36c",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / chai-as-format

Package

Name
chai-as-format
View open source insights on deps.dev
Purl
pkg:npm/chai-as-format

Affected ranges

Affected versions

2.*
2.3.5

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/config.js",
            "sha256": "ef7a5abedd9be15b8f63cd56aca72913f2858678bcd4148b96030b304e7ca5e4",
            "tlsh": "861672889581c43395ce16a3ff2d6ae8f13a79f1c4c8a54bc569bc9c2dac91fd1a0dd0"
        },
        {
            "path": "package.json",
            "sha256": "7a4ac3a5e8465319a497f5e51330a71c9a71de00d345be1800df4beafff8a3de",
            "tlsh": "da017b20da7c4e6304ed25524c2a06437a614c575528fd1932db512d0f9d5fb01bf21d"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "661f25746ae598c618bd1db13207f97f2dc4d3c4",
                "sha512_sri": "sha512-YSsITYlrzPaHEEC22QhRIOKZg+ADBq3n80QU0xM5o5daQh3KAa+BdCG98mDEKiIeope8uUbw2tNmx01wcTfhOQ=="
            },
            "filename": "chai-as-format-2.3.5.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-format/MAL-2026-13701.json"