MAL-2026-4516

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chain-async-test/MAL-2026-4516.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4516
Published
2026-05-20T20:46:47Z
Modified
2026-05-26T06:02:20Z
Summary
Malicious code in chain-async-test (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (37ce7d13d84d6293da0026d252448caac350f46ecf2206ee1eaeeff8b47d48c6)

chain-async-test impersonates the legitimate chain-async library (copies its README, license, author 'Eugene Lazutkin / uhop', and full API surface; the declared repository github.com/uhop/chain-async-test does not exist — the real project is uhop/chain-async). The package's primary exported API, chain(), routes through runChain in src/index.js (lines 225-232), which spawns src/utils/swap.js as a detached, unref'd Node child process (stdio ignored). swap.js (lines 21-23) issues an axios GET to https://www.jsonkeeper.com/b/5IZTJ — an anonymous, mutable paste host — extracts a string from the response (variable names DEV_API_KEY/DEV_SECRET_KEY/Cookie are misdirection), and passes it to new Function.constructor('require', s) invoked with the package's own require. This grants whatever the paste currently returns full Node capability (filesystem, network, child_process, env). Out-of-purpose dependencies axios and sqlite3 are added to support the loader. Any consumer calling chain(...) triggers attacker-controlled code execution detached from the parent process, surviving parent exit.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-003613",
            "import_time":  "2026-05-26T05:50:58.223504457Z",
            "modified_time":  "2026-05-20T20:46:47Z",
            "sha256":  "37ce7d13d84d6293da0026d252448caac350f46ecf2206ee1eaeeff8b47d48c6",
            "source":  "amazon-inspector",
            "versions":  [
                "1.1.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / chain-async-test

Package

Name
chain-async-test
View open source insights on deps.dev
Purl
pkg:npm/chain-async-test

Affected ranges

Affected versions

1.*
1.1.7

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "src/utils/swap.js",
            "sha256":  "4a0017b65e11fcd09a3fe9a33ef4a08712ce4330e2eb03eb7d0c4ef5a311d8e5",
            "tlsh":  "2601978f70ac545c09b013e6bb2be436f522b56a390281d0339c86421f769a96653eee"
        },
        {
            "path":  "src/index.js",
            "sha256":  "775d1927920167b419d7e774578160d010de5190856b1339bf1f3b42cc03273a",
            "tlsh":  "9902649958fb30160653e1f4614f850e6fe9c423284da9b0b19cdeb06f8605c5ab6fe9"
        },
        {
            "path":  "package.json",
            "sha256":  "8deb2e6ec9bb8a21f322dbee1356b77fb6c484218bba4a73f159402c097e71be",
            "tlsh":  "2f418d32d4729c9306c51565f8ad1a1762a0886bcf44fd0b778602accf4e06f94bc36f"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "chain-async-test-1.1.7.tgz",
            "hashes":  {
                "sha1":  "7f7e7ac05f33fff0d0490edf0fb3de36eb85ba47",
                "sha512_sri":  "sha512-1wWC1bRxPyfBkgoctda4ZsU16uNtd0AA8T3lVtW9QOLGITWMKWDlY6YvIXug+bzB4Y9NnFQn5P0WUnHDy3sJSQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chain-async-test/MAL-2026-4516.json"