MAL-2026-5903

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-guid/MAL-2026-5903.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5903
Published
2026-06-16T16:22:49Z
Modified
2026-07-23T07:51:07.767557032Z
Summary
Malicious code in chai-guid (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (69e9bcacf8dca52aafe4d93019b888c6d32e344b500a21368f036bf586eee161)

chai-guid impersonates the pino logger and the chai-guid chai plugin (README copies pino badges and pinojs CI links; index.js exports middleware as module.exports.pino). When a consumer calls the exported middleware, index.js spawns lib/caller.js as a detached Node process with stdio ignored. lib/caller.js performs axios.get('https://jsonkeeper.com/b/U2BTS'), reads the .cookie field of the response, and executes it via new Function.constructor('require', s)(require) — running attacker-controlled JavaScript with full Node privileges and require injected. A second base64-encoded URL (https://jsonkeeper.com/b/XRGF3) is hidden in a fake process.env.DEV_API_KEY shim in lib/caller.js and lib/const.js as a secondary C2 endpoint. jsonkeeper.com is an anonymous, mutable JSON-paste host; whatever bytes the attacker pastes there will be executed on the installer's machine the moment any consumer invokes the package's middleware.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-16T18:10:20.558097863Z",
            "modified_time": "2026-06-16T16:22:49Z",
            "versions": [
                "1.1.5"
            ],
            "source": "amazon-inspector",
            "sha256": "69e9bcacf8dca52aafe4d93019b888c6d32e344b500a21368f036bf586eee161",
            "id": "IN-MAL-2026-006791"
        },
        {
            "import_time": "2026-07-20T13:14:44.481842108Z",
            "modified_time": "2026-07-20T10:36:57Z",
            "versions": [
                "1.1.5"
            ],
            "source": "reversing-labs",
            "sha256": "a26b871b61bc8aa514a61a0842780c115c29e9da47d4291ed9953edf041833e4",
            "id": "RLMA-2026-05510"
        }
    ]
}
References
Credits

Affected packages

npm / chai-guid

Package

Name
chai-guid
View open source insights on deps.dev
Purl
pkg:npm/chai-guid

Affected ranges

Affected versions

1.*
1.1.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-guid/MAL-2026-5903.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "chai-guid-1.1.5.tgz",
            "hashes": {
                "sha512_sri": "sha512-gRwBjAJ8G9BHyw8lbqZJxZ9SofBUrsveVDnYW8FTBM9972sa2Jfs7GfK+Mjtk/PjBCylIWyj+E5fSE8pYSO22A==",
                "sha1": "55fcb809a1ed7af8b7fba2f7923688c4a793253f"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "lib/caller.js",
            "sha256": "6e9c6643cf66d24db6350eb1c03d6f0f862243ee18ab557c9be20d847dff9f36",
            "tlsh": "c2017b4a30fa605c015510f64b1fe4317012e4173c49e5c5378c87514fea5ae6963eed"
        },
        {
            "path": "package.json",
            "sha256": "eb7b3421ed751a4f2d536fe39b40d10c5839196fc4e2c1c34f0a4431a08fb2b3",
            "tlsh": "88019761ce788e2304ed25928c2e0643ba619c079828fc2d32db512c4f9e9bf01bf25d"
        }
    ]
}