MAL-2026-13702

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-map/MAL-2026-13702.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13702
Published
2026-08-10T12:29:46Z
Modified
2026-08-10T13:04:59.009183836Z
Summary
Malicious code in chai-as-map (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d3e93684202a75938b3139b209943cf55c34ea8ff9a215a6ead907e36d8ab953)

The package presents itself as a chai-related utility (name chai-as-map, keywords logger/stream/json, description referencing vulnerability management) and bundles verbatim pino logger source under lib/ (proto.js, levels.js, redaction.js, docs/pino.md, LICENSE crediting pinojs), while the exported API in index.js is only a no-op Express middleware. index.js requires./lib/config on module load, and lib/config.js is a 4,083,409-byte obfuscator.io-style hex string array (~23,953 entries) with rotated decoders and control-flow flattening, containing no readable code. Loading the package therefore executes an opaque 4MB blob at import time. package.json also declares axios ^1.10.0 as a runtime dependency despite the advertised middleware performing no network I/O, aligning the module graph with a loader that reconstructs a remote destination from the obfuscated strings at runtime. The combination of typosquat naming, cover-story pino contents, an unrelated no-op public API, and a large obfuscated payload auto-executed on require is the shape of a stealer/loader delivered through name confusion.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017266",
            "import_time": "2026-08-10T12:51:45.058228235Z",
            "sha256": "d3e93684202a75938b3139b209943cf55c34ea8ff9a215a6ead907e36d8ab953",
            "modified_time": "2026-08-10T12:29:46Z",
            "source": "amazon-inspector",
            "versions": [
                "2.3.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / chai-as-map

Package

Name
chai-as-map
View open source insights on deps.dev
Purl
pkg:npm/chai-as-map

Affected ranges

Affected versions

2.*
2.3.5

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/config.js",
            "tlsh": "861672889581c43395ce16a3ff2d6ae8f13a79f1c4c8a54bc569bc9c2dac91fd1a0dd0",
            "sha256": "ef7a5abedd9be15b8f63cd56aca72913f2858678bcd4148b96030b304e7ca5e4"
        },
        {
            "path": "package.json",
            "tlsh": "b2017b20da7c4e6300ed25524c2a06437a714c175628fd1932db512d0f9d5fb01ff21d",
            "sha256": "28ed5d83943be14531f090a1723d6d3a5009c31330dad57f4630891ff258d89d"
        }
    ],
    "package_integrity": [
        {
            "filename": "chai-as-map-2.3.5.tgz",
            "hashes": {
                "sha1": "77098816eb5d8050bad476c9baa5008ca276e43c",
                "sha512_sri": "sha512-3Tx707iJxcALwYzSVFxjdhBu6/jsQBU/D4PuKU4FBE30EESL+CFEro5wDmWOwTIQBqh80Ua/q4dmkaTNCY5KXw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-map/MAL-2026-13702.json"