MAL-2026-14427

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-mno/MAL-2026-14427.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14427
Published
2026-08-24T16:46:38Z
Modified
2026-08-24T17:00:12Z
Summary
Malicious code in chai-as-mno (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2e94e194f078c230d6c6b15efcddc54b133fd52c890a55b0f8bdb4c680452381)

The package name mimics chai-as-promised and its README, badges, and license text are copied from an unrelated project (pino), while the package.json description is unrelated boilerplate. The declared main index.js exports a trivial no-op Express middleware (_req,_res,next)=>next() and unconditionally executes require('./lib/config') at import time. lib/config.js is a ~4MB single-line file heavily obfuscated with an obfuscator.io string-array scheme (string array d of length 23971 with rotation, hex-named identifiers, nested decoder functions j/T, control-flow flattening, and ~40,000 inline-decoded strings). The visible surface API provides no legitimate reason to ship a multi-megabyte opaque blob as a config module, and merely requiring the package runs that payload in the installer's Node process. The combination of impersonation cover story, mismatched README/description, no-op public API, and an obfuscator.io-grade payload executed on require is the loader/dropper shape.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-018654",
            "import_time":  "2026-08-24T16:49:15.227705107Z",
            "modified_time":  "2026-08-24T16:46:38Z",
            "sha256":  "2e94e194f078c230d6c6b15efcddc54b133fd52c890a55b0f8bdb4c680452381",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / chai-as-mno

Package

Name
chai-as-mno
View open source insights on deps.dev
Purl
pkg:npm/chai-as-mno

Affected ranges

Affected versions

1.*
1.0.5

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "2f8c33b60aca4c86ba0782e243b8dad22450bc60d50af1f2ce3c71062119b745",
            "tlsh":  "1411009134d660cf8d3cdad0f2306515acdbc677260752b3befc9bc927860081161faa"
        },
        {
            "path":  "lib/config.js",
            "sha256":  "f50f58b138120fab51de3d3d98fb96d24bd3cee998f3fcc27895344821910383",
            "tlsh":  "e4165f889645c93796ce17a3be0579ecf23aa9a194cca50b80bdbd5c39fc45bc0b0dd4"
        },
        {
            "path":  "package.json",
            "sha256":  "7870b4c89425b2072483d4bd3bc99b92315c372fba71ca694c76474fcd27c936",
            "tlsh":  "93019c20cd789d2301dd21525c6a4642b3224d174928fd1833d7a12d4f9f9af01bf15c"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "chai-as-mno-1.0.5.tgz",
            "hashes":  {
                "sha1":  "35b6b00a11c352da10054dc98a8529952b06dd5f",
                "sha512_sri":  "sha512-8C9+yWdeZRoFLe7Lfi1irW3sdPRrv1z8ZZLGq58jfvPWvHrtS5JmfM51QRUgfPLhE2rtbDO/Yzf1kEbqJHqqrA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-mno/MAL-2026-14427.json"