MAL-2026-17189

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-relay/MAL-2026-17189.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17189
Published
2026-09-26T15:14:59Z
Modified
2026-09-26T15:30:05Z
Summary
Malicious code in chai-as-relay (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5c65319b0e17f945fc57f482eb174e5d7fe70e63a380cb24f64eea1808bdad2f)

Package main index.js unconditionally requires./lib/config at module load. lib/config.js is a single-line ~4.4MB obfuscator.io-packed IIFE (hex-escaped string-array of 26,102 entries, rotated with wrapper decoders, control-flow flattening, ~133k transform changes) that self-invokes at top level. Any consumer that require('chai-as-relay') executes this opaque bundle in-process. The remainder of the tarball (README, LICENSE, index.d.ts, lib/proto, etc.) is copied verbatim from the legitimate pino logger project, and index.js additionally exports a no-op Express-style middleware — the package's advertised identity is a cover for the dropper. The package.json name (chai-as-relay) and author (hello@jsonspack.com) have no relationship to pino or its maintainers. A heavily obfuscated, multi-megabyte, self-executing blob wired into the require entry of a package that impersonates a top-tier logger has no legitimate purpose and gives whoever controls the payload arbitrary code execution on every installer that imports the package.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020563",
            "import_time":  "2026-09-26T15:16:15.775157869Z",
            "modified_time":  "2026-09-26T15:14:59Z",
            "sha256":  "5c65319b0e17f945fc57f482eb174e5d7fe70e63a380cb24f64eea1808bdad2f",
            "source":  "amazon-inspector",
            "versions":  [
                "1.2.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / chai-as-relay

Package

Name
chai-as-relay
View open source insights on deps.dev
Purl
pkg:npm/chai-as-relay

Affected ranges

Affected versions

1.*
1.2.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "lib/config.js",
            "sha256":  "cc93ac7310b3a044badfc17f112a763bb24452ca88236892a470fdd362a9af36",
            "tlsh":  "8626a5c8494ae06389de26d37e0639d9e33b5d66d4eca5a7c66cbc9c6cbc447c0a1cd0"
        },
        {
            "path":  "package.json",
            "sha256":  "37af31772ae215ad9ab85f2f37a7c46cbec4bb7b0a10ae13b7b4f19b84778a84",
            "tlsh":  "2a017620deb88e2300ed25924c2a0643ba714c479529fd2933dba12c4fad9bb01bf21d"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "chai-as-relay-1.2.1.tgz",
            "hashes":  {
                "sha1":  "b78835bcec5b368ed0695706aa6eb15ab0c80a1b",
                "sha512_sri":  "sha512-Gzsi2w4ZEctlgEoQLU5pWM9oD/wKesHwq0uy3SC8wKcvJoLHFcvzvhtAAdQwqueChEII6ZTkaqQYE3XKY2h51Q=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-relay/MAL-2026-17189.json"