Malicious code in chaikit (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a4711ba83393e8da11ab4368f9b38dac3de00bc523946cc27e4e47f38a51b9c4) The package's main entry (index.js) unconditionally requires./lib/config, a ~4MB obfuscator.io-style file (RC4 string-array decoder with ~23,902 entries, hex-encoded property names) whose top-level IIFE self-executes on load. Any consumer that imports chaikit runs this opaque code in their process. The advertised middleware in index.js is a trivial next() passthrough, so the obfuscated blob is the only substantive behavior of the package. package.json bundles axios as a runtime dependency, giving the opaque code a network egress channel. The README impersonates the pino logger (pino badges, pinojs/pino links, chai/chai-kit usage snippet), while the package.json description is unrelated boilerplate ('management of vulnerabilities') and file.js references a nonexistent./pino module — cover-story metadata consistent with a package published to be resolved by developers searching for chai or pino tooling. The combination of import-time execution of a large opaque blob, a mismatched cover story, and a bundled HTTP client is the canonical loader shape of an installer-harm supply-chain payload. ## Source: ghsa-malware (c8ef67981413b5e78e398269cd9cb77c6cb1e9f52b60af03113538581e11c225) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should b
MAL-2026-14201
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-14201
chaikit
Source reference: /affected/0/package/name
- Affected versions
- 2.3.5
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "chaikit",
"purl": "pkg:npm/chaikit",
"ecosystem": "npm"
},
"versions": [
"2.3.5"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chaikit/MAL-2026-14201.json",
"indicators": {
"evidence_files": [
{
"path": "lib/config.js",
"tlsh": "e81674cc6688e423c1cc2b93be0539abf17a686294c8a167df557d5db8bc40bc1a4fd4",
"sha256": "88d8da1b1148a07973cd1ec96d1f67d4f672b83635ec342783c1df6e38a4ad0c"
},
{
"path": "index.js",
"tlsh": "0421149124d560ce9938dac0f6306115acdbc677260752b3bdfc97c927860080161fba",
"sha256": "4e6c4e61a7019ab0affe9c2d20e36701b330ec357be205930355bac1464f9316"
},
{
"path": "package.json",
"tlsh": "b6017b20da784e2301ed25524c2a06437a654c575528fc2932db512d0f9d5fb05bf21d",
"sha256": "6cea40708f1d8e795b580d4f171644e15cd1ce21594cb7dc05189030b0ec8e75"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "b6114010391367e1ef7edb2fd031f3ee67e4b58e",
"sha512_sri": "sha512-gN+9azR+KKHGISKTJD2gYZEf28tubkMgeH/2UKVUcnVxWQzVp11hC/uZEPFICdBsTJJpsnY9i1yRweEZrUhbEg=="
},
"filename": "chaikit-2.3.5.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #22653 · Revision 1
- Added to Heist Feed
- Publisher date