Malicious code in chai-as-relay (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5c65319b0e17f945fc57f482eb174e5d7fe70e63a380cb24f64eea1808bdad2f) Package main index.js unconditionally requires./lib/config at module load. lib/config.js is a single-line ~4.4MB obfuscator.io-packed IIFE (hex-escaped string-array of 26,102 entries, rotated with wrapper decoders, control-flow flattening, ~133k transform changes) that self-invokes at top level. Any consumer that `require('chai-as-relay')` executes this opaque bundle in-process. The remainder of the tarball (README, LICENSE, index.d.ts, lib/proto, etc.) is copied verbatim from the legitimate `pino` logger project, and index.js additionally exports a no-op Express-style middleware — the package's advertised identity is a cover for the dropper. The package.json name (`chai-as-relay`) and author (hello@jsonspack.com) have no relationship to pino or its maintainers. A heavily obfuscated, multi-megabyte, self-executing blob wired into the require entry of a package that impersonates a top-tier logger has no legitimate purpose and gives whoever controls the payload arbitrary code execution on every installer that imports the package.
MAL-2026-17189
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17189
chai-as-relay
Source reference: /affected/0/package/name
- Affected versions
- 1.2.1
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "chai-as-relay",
"purl": "pkg:npm/chai-as-relay",
"ecosystem": "npm"
},
"versions": [
"1.2.1"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-relay/MAL-2026-17189.json",
"indicators": {
"evidence_files": [
{
"path": "lib/config.js",
"tlsh": "8626a5c8494ae06389de26d37e0639d9e33b5d66d4eca5a7c66cbc9c6cbc447c0a1cd0",
"sha256": "cc93ac7310b3a044badfc17f112a763bb24452ca88236892a470fdd362a9af36"
},
{
"path": "package.json",
"tlsh": "2a017620deb88e2300ed25924c2a0643ba714c479529fd2933dba12c4fad9bb01bf21d",
"sha256": "37af31772ae215ad9ab85f2f37a7c46cbec4bb7b0a10ae13b7b4f19b84778a84"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "b78835bcec5b368ed0695706aa6eb15ab0c80a1b",
"sha512_sri": "sha512-Gzsi2w4ZEctlgEoQLU5pWM9oD/wKesHwq0uy3SC8wKcvJoLHFcvzvhtAAdQwqueChEII6ZTkaqQYE3XKY2h51Q=="
},
"filename": "chai-as-relay-1.2.1.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #18969 · Revision 1
- Added to Heist Feed
- Publisher date