🛡️ MAL-2026-2740 — chai-as-type

Malicious code in chai-as-type (npm)

chai-as-type is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint[.]io/c26313f0733957a7d787 and executes it (similar to malware in to chai-await-test).

Source: amazon-inspector

The package name impersonates the popular chai / chai-as-promised assertion libraries, but the code is an unrelated pino-shaped middleware whose only side effect is launching a remote-code loader. lib/caller.js issues an axios GET to https://jsonkeeper.com/b/XRGF3 (an anonymous public JSON paste host), takes the returned data.cookie string, constructs new Function.constructor('require', s), and invokes it with the live require — executing arbitrary attacker-controlled JavaScript in the installer's Node process with full module access. The C2 URL is base64-encoded and stashed under fake DEV_API_KEY / DEV_SECRET_KEY keys on a locally redeclared process object (aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1hSR0Yz decodes to the jsonkeeper URL); a sibling encoded URL .../b/4NAKK lives in lib/const.js. The loader is reached two ways: (1) when the exported pino middleware is invoked, index.js detaches a child_process.spawn('node', ['lib/caller.js',...]); (2) the package's smoke:pino npm script runs index.js directly. The paste-host content is mutable by the attacker at any time, so each fetch can deliver fresh payloads (credential theft, persistence, etc.) without re-publishing the package.