MAL-2026-14201

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chaikit/MAL-2026-14201.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14201
Published
2026-08-19T01:59:26Z
Modified
2026-08-19T02:45:11.163245380Z
Summary
Malicious code in chaikit (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a4711ba83393e8da11ab4368f9b38dac3de00bc523946cc27e4e47f38a51b9c4)

The package's main entry (index.js) unconditionally requires./lib/config, a ~4MB obfuscator.io-style file (RC4 string-array decoder with ~23,902 entries, hex-encoded property names) whose top-level IIFE self-executes on load. Any consumer that imports chaikit runs this opaque code in their process. The advertised middleware in index.js is a trivial next() passthrough, so the obfuscated blob is the only substantive behavior of the package. package.json bundles axios as a runtime dependency, giving the opaque code a network egress channel. The README impersonates the pino logger (pino badges, pinojs/pino links, chai/chai-kit usage snippet), while the package.json description is unrelated boilerplate ('management of vulnerabilities') and file.js references a nonexistent./pino module — cover-story metadata consistent with a package published to be resolved by developers searching for chai or pino tooling. The combination of import-time execution of a large opaque blob, a mismatched cover story, and a bundled HTTP client is the canonical loader shape of an installer-harm supply-chain payload.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T02:31:08.434609818Z",
            "sha256": "a4711ba83393e8da11ab4368f9b38dac3de00bc523946cc27e4e47f38a51b9c4",
            "modified_time": "2026-08-19T01:59:26Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018287",
            "versions": [
                "2.3.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / chaikit

Package

Name
chaikit
View open source insights on deps.dev
Purl
pkg:npm/chaikit

Affected ranges

Affected versions

2.*
2.3.5

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chaikit/MAL-2026-14201.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "88d8da1b1148a07973cd1ec96d1f67d4f672b83635ec342783c1df6e38a4ad0c",
            "tlsh": "e81674cc6688e423c1cc2b93be0539abf17a686294c8a167df557d5db8bc40bc1a4fd4",
            "path": "lib/config.js"
        },
        {
            "sha256": "4e6c4e61a7019ab0affe9c2d20e36701b330ec357be205930355bac1464f9316",
            "tlsh": "0421149124d560ce9938dac0f6306115acdbc677260752b3bdfc97c927860080161fba",
            "path": "index.js"
        },
        {
            "sha256": "6cea40708f1d8e795b580d4f171644e15cd1ce21594cb7dc05189030b0ec8e75",
            "tlsh": "b6017b20da784e2301ed25524c2a06437a654c575528fc2932db512d0f9d5fb05bf21d",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "chaikit-2.3.5.tgz",
            "hashes": {
                "sha1": "b6114010391367e1ef7edb2fd031f3ee67e4b58e",
                "sha512_sri": "sha512-gN+9azR+KKHGISKTJD2gYZEf28tubkMgeH/2UKVUcnVxWQzVp11hC/uZEPFICdBsTJJpsnY9i1yRweEZrUhbEg=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]