MAL-2026-14427

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-mno/MAL-2026-14427.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14427
Published
2026-08-24T16:46:38Z
Modified
2026-08-24T17:00:12.596385801Z
Summary
Malicious code in chai-as-mno (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2e94e194f078c230d6c6b15efcddc54b133fd52c890a55b0f8bdb4c680452381)

The package name mimics chai-as-promised and its README, badges, and license text are copied from an unrelated project (pino), while the package.json description is unrelated boilerplate. The declared main index.js exports a trivial no-op Express middleware (_req,_res,next)=>next() and unconditionally executes require('./lib/config') at import time. lib/config.js is a ~4MB single-line file heavily obfuscated with an obfuscator.io string-array scheme (string array d of length 23971 with rotation, hex-named identifiers, nested decoder functions j/T, control-flow flattening, and ~40,000 inline-decoded strings). The visible surface API provides no legitimate reason to ship a multi-megabyte opaque blob as a config module, and merely requiring the package runs that payload in the installer's Node process. The combination of impersonation cover story, mismatched README/description, no-op public API, and an obfuscator.io-grade payload executed on require is the loader/dropper shape.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.5"
            ],
            "source": "amazon-inspector",
            "sha256": "2e94e194f078c230d6c6b15efcddc54b133fd52c890a55b0f8bdb4c680452381",
            "id": "IN-MAL-2026-018654",
            "modified_time": "2026-08-24T16:46:38Z",
            "import_time": "2026-08-24T16:49:15.227705107Z"
        }
    ]
}
References
Credits

Affected packages

npm / chai-as-mno

Package

Name
chai-as-mno
View open source insights on deps.dev
Purl
pkg:npm/chai-as-mno

Affected ranges

Affected versions

1.*
1.0.5

Database specific

indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "2f8c33b60aca4c86ba0782e243b8dad22450bc60d50af1f2ce3c71062119b745",
            "tlsh": "1411009134d660cf8d3cdad0f2306515acdbc677260752b3befc9bc927860081161faa"
        },
        {
            "path": "lib/config.js",
            "sha256": "f50f58b138120fab51de3d3d98fb96d24bd3cee998f3fcc27895344821910383",
            "tlsh": "e4165f889645c93796ce17a3be0579ecf23aa9a194cca50b80bdbd5c39fc45bc0b0dd4"
        },
        {
            "path": "package.json",
            "tlsh": "93019c20cd789d2301dd21525c6a4642b3224d174928fd1833d7a12d4f9f9af01bf15c",
            "sha256": "7870b4c89425b2072483d4bd3bc99b92315c372fba71ca694c76474fcd27c936"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "35b6b00a11c352da10054dc98a8529952b06dd5f",
                "sha512_sri": "sha512-8C9+yWdeZRoFLe7Lfi1irW3sdPRrv1z8ZZLGq58jfvPWvHrtS5JmfM51QRUgfPLhE2rtbDO/Yzf1kEbqJHqqrA=="
            },
            "filename": "chai-as-mno-1.0.5.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-mno/MAL-2026-14427.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]