MAL-2026-2740

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-type/MAL-2026-2740.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-2740
Aliases
  • GHSA-38w3-8j54-936j
Published
2026-04-15T22:05:03Z
Modified
2026-09-01T11:31:29Z
Summary
Malicious code in chai-as-type (npm)
Details

chai-as-type is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint[.]io/c26313f0733957a7d787 and executes it (similar to malware in to chai-await-test).

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (75650bd9993ad4d310c42309ea4f185f9ec2bca169073315a9a1604c76830e41)

The package name impersonates the popular chai / chai-as-promised assertion libraries, but the code is an unrelated pino-shaped middleware whose only side effect is launching a remote-code loader. lib/caller.js issues an axios GET to https://jsonkeeper.com/b/XRGF3 (an anonymous public JSON paste host), takes the returned data.cookie string, constructs new Function.constructor('require', s), and invokes it with the live require — executing arbitrary attacker-controlled JavaScript in the installer's Node process with full module access. The C2 URL is base64-encoded and stashed under fake DEV_API_KEY / DEV_SECRET_KEY keys on a locally redeclared process object (aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1hSR0Yz decodes to the jsonkeeper URL); a sibling encoded URL .../b/4NAKK lives in lib/const.js. The loader is reached two ways: (1) when the exported pino middleware is invoked, index.js detaches a child_process.spawn('node', ['lib/caller.js',...]); (2) the package's smoke:pino npm script runs index.js directly. The paste-host content is mutable by the attacker at any time, so each fetch can deliver fresh payloads (credential theft, persistence, etc.) without re-publishing the package.

Database specific 
{
    "iocs": {
        "urls": [
            "https://api.npoint.io/c26313f0733957a7d787"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "RLMA-2026-01916",
            "import_time": "2026-04-16T15:38:56.690919983Z",
            "modified_time": "2026-04-16T09:48:55Z",
            "sha256": "ca8f85334ab437b20dd22839623379d7b662d0b6f8cce2b38e4c953196d4c48f",
            "source": "reversing-labs",
            "versions": [
                "7.0.5"
            ]
        },
        {
            "import_time": "2026-04-23T20:49:08.983509368Z",
            "modified_time": "2026-04-23T20:43:56Z",
            "sha256": "c48e79ab60bf33822b131a30be07b07afee7fe9feed4439ac5f43988283001ac",
            "source": "amazon-inspector",
            "versions": [
                "7.0.5"
            ]
        },
        {
            "id": "IN-MAL-2026-003904",
            "import_time": "2026-05-26T05:51:33.048401302Z",
            "modified_time": "2026-05-21T16:28:40Z",
            "sha256": "75650bd9993ad4d310c42309ea4f185f9ec2bca169073315a9a1604c76830e41",
            "source": "amazon-inspector",
            "versions": [
                "1.1.9"
            ]
        },
        {
            "id": "RLUA-2026-05001",
            "import_time": "2026-07-09T09:17:06.516642586Z",
            "modified_time": "2026-07-07T12:43:35Z",
            "sha256": "23b7a3bd70fe91ee116fd88d8755b2de97f305f5c5ce8d64f25ab9a59b08299b",
            "source": "reversing-labs",
            "versions": [
                "1.1.9"
            ]
        },
        {
            "id": "RLUA-2026-06131",
            "import_time": "2026-09-01T11:17:59.677775717Z",
            "modified_time": "2026-08-24T16:43:43Z",
            "sha256": "7d81a1d9c328b80c30a2f8d2fdcef23999b2c5a9b4b8db7ccb0029e5f7adf2bf",
            "source": "reversing-labs"
        }
    ]
}
References
Credits

Affected packages

npm / chai-as-type

Package

Name
chai-as-type
View open source insights on deps.dev
Purl
pkg:npm/chai-as-type

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.1.9
7.*
7.0.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/caller.js",
            "sha256": "d81e48769a830cd3384a4b8977ade12e5ab7583eb7cca84e7ab966d15871bd71",
            "tlsh": "f8017b8a30fa605c015510f64b1fa4327011e4273c49e5c5378c87524fea9ae6963aed"
        },
        {
            "path": "package.json",
            "sha256": "ee7f43af72a5000ba73b6cf630067707e9ad7269d6c17996abc13dbacfba49e0",
            "tlsh": "09019761ce788e2300ed25824c2e0643ba719c079828fc2d32db512d4f9e9bf01bf21d"
        }
    ],
    "package_integrity": [
        {
            "filename": "chai-as-type-1.1.9.tgz",
            "hashes": {
                "sha1": "77a8fb23496806bdd27676dc15995862109cdf44",
                "sha512_sri": "sha512-mFlnECLksRgkNcSlHuWwRq0pGQ0n1t9a8B5i4FDXOtFfciSvCSVH5EC4QV1mT3GMln5cmZAGqSokVBknlTQ8/A=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-type/MAL-2026-2740.json"