MAL-2026-16077

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-sleek/MAL-2026-16077.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-16077
Published
2026-09-09T06:49:23Z
Modified
2026-09-09T07:02:26Z
Summary
Malicious code in chai-as-sleek (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (782914cb65e0d30697eb54f50a4c5b740a3a53941abc185759e296c1d2ec8e9e)

Package published as 'chai-as-sleek' impersonates the pino logger: README, LICENSE, docs/, and index.d.ts are copied verbatim from pino, while package.json description reads 'This document describes the management of vulnerabilities...' and the README also markets the package as a chai plugin. The main entrypoint index.js unconditionally executes require('./lib/config') at load time. lib/config.js is a single ~4 MB line of obfuscator.io-obfuscated JavaScript (23,868-entry rotated string array, decoder functions T and j, control-flow flattening, ~20k decoder-wrapper calls) with no configuration content. package.json declares axios ^1.10.0 as a runtime dependency, but no readable source file imports axios — the only reachable consumer of the HTTP client is the opaque blob in lib/config.js. Any consumer that imports 'chai-as-sleek' executes this hidden payload at require() time with outbound HTTP capability provisioned.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019847",
            "import_time": "2026-09-09T06:54:01.295527278Z",
            "modified_time": "2026-09-09T06:49:23Z",
            "sha256": "782914cb65e0d30697eb54f50a4c5b740a3a53941abc185759e296c1d2ec8e9e",
            "source": "amazon-inspector",
            "versions": [
                "7.1.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / chai-as-sleek

Package

Name
chai-as-sleek
View open source insights on deps.dev
Purl
pkg:npm/chai-as-sleek

Affected ranges

Affected versions

7.*
7.1.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/config.js",
            "sha256": "df4970a67c9caae5dd2e4603ea726f7624a4c17bb197a1039985a10ff9b56923",
            "tlsh": "f016818d5685d42381cc2793be057ae9b17ae96684cca447ff74bf1c69bc41bc2a0ed0"
        },
        {
            "path": "package.json",
            "sha256": "cbe9ebb8aa8e34a0ba93790ce750f864c3cf9854bd7d1deabd8a982d8c924a28",
            "tlsh": "c6017b20da785e2304ed25425c2a0603b6614c579528fd1932dba12c4f9d5fb01bf21d"
        }
    ],
    "package_integrity": [
        {
            "filename": "chai-as-sleek-7.1.2.tgz",
            "hashes": {
                "sha1": "bc2bf2596e535cb196e1632b0e18e826ebf42f84",
                "sha512_sri": "sha512-ODrLagHQLbSHHqYBdtn3ckGXGFT+2EwmXyAC5GZWO3EoUQPQ8MWXEVeABCEhY507IIejmLq/choSvz59BX+2uw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-sleek/MAL-2026-16077.json"