🛡️ MAL-2026-10042 — chai-as-disarmed

Malicious code in chai-as-disarmed (npm)

Source: amazon-inspector

Package name typosquats chai-as-promised while the README and keywords impersonate pino to bait installs. On require(), index.js detach-spawns lib/caller.js, which decodes a base64-stored URL to https://api.jsonstorage.net/v1/json/2ef8c758-.../a179ea35-..., issues an authenticated GET (header name and value are also base64-hidden inside a local object that shadows process.env), and executes the returned .cookie string via new Function.constructor('require', s)(require) — granting the remote operator arbitrary code execution in the installer's Node.js process with full require access. The fetch retries up to 5 times. The remote content sits in a mutable third-party JSON store, so the executed payload can be swapped at any time without republishing the package. None of this behavior corresponds to the advertised chai/pino functionality.