Malicious code in chai-as-deployer (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c4da130c2818dc609c23c93511a70a6c207cf19cdf9fdd937e369e07b5f1e492) The package is published as `chai-as-deployer` but its tarball contains verbatim pino README/docs/type-definitions while the advertised chai plugin is a no-op Express middleware (`return (_req,_res,next) => { next(); }`). index.js unconditionally executes `require('./lib/config')` at module top level, loading a ~3.5MB single-line obfuscator.io-style bundle (rotated string array, decoder functions, hex-escaped identifiers) that has no relationship to pino or the advertised functionality. The obfuscated body contains `require`, `exec`, `spawn`, and `axios` tokens, indicating the decoded code drives child-process execution and outbound HTTP requests. Any consumer that imports `chai-as-deployer` triggers this payload with no further action. Author metadata is generic (`Harrison Thorn `, bugs URL `harrisonthorn.com`) and the package description is unrelated boilerplate. The combination of cover-story impersonation, no legitimate functionality, top-level require of a heavily obfuscated bundle, and shell+network primitives inside that bundle is the canonical shape of an import-time stealer/loader. ## Source: ghsa-malware (cb63584d83487c7d7ce3b9d031d79502412fd048c2260a05b0a8ef98aa23ef59) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer shoul
MAL-2026-13700
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-13700
chai-as-deployer
Source reference: /affected/0/package/name
- Affected versions
- 2.3.6
Source reference:
/affected/0/versions2.3.5Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "chai-as-deployer",
"purl": "pkg:npm/chai-as-deployer",
"ecosystem": "npm"
},
"versions": [
"2.3.6",
"2.3.5"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-deployer/MAL-2026-13700.json",
"indicators": {
"evidence_files": [
{
"path": "lib/config.js",
"tlsh": "e4165f889645c93796ce17a3be0579ecf23aa9a194cca50b80bdbd5c39fc45bc0b0dd4",
"sha256": "f50f58b138120fab51de3d3d98fb96d24bd3cee998f3fcc27895344821910383"
},
{
"path": "package.json",
"tlsh": "cb014c20ce789d2305dd21525c6a4542b3324d178928fd1932d7a12e4f9f5af55bf15c",
"sha256": "a67ac415fc949eb5e30a1429ff9af59f7687684df04b6711bbd52f40a85ca3b3"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "652f5bd2858d9093ccb1e12ecec653f354b45703",
"sha512_sri": "sha512-XfvA5y9k+fTQ3zQXWn0LmArsYnQVo8OK+lwl4TX1XgfQfFqi5/38f6KOMs39dZy4d1xIylQ+Yebr4wi0Pu32Mw=="
},
"filename": "chai-as-deployer-2.3.6.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #10867 · Revision 1
- Added to Heist Feed
- Publisher date