{"id":"MAL-2026-17189","revision":"b7c7b4e590cf4d0e9220cb9dc60d91d5","records":[{"revision":"b7c7b4e590cf4d0e9220cb9dc60d91d5","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17189","aliases":[],"title":"Malicious code in chai-as-relay (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5c65319b0e17f945fc57f482eb174e5d7fe70e63a380cb24f64eea1808bdad2f)\nPackage main index.js unconditionally requires./lib/config at module load. lib/config.js is a single-line ~4.4MB obfuscator.io-packed IIFE (hex-escaped string-array of 26,102 entries, rotated with wrapper decoders, control-flow flattening, ~133k transform changes) that self-invokes at top level. Any consumer that `require('chai-as-relay')` executes this opaque bundle in-process. The remainder of the tarball (README, LICENSE, index.d.ts, lib/proto, etc.) is copied verbatim from the legitimate `pino` logger project, and index.js additionally exports a no-op Express-style middleware — the package's advertised identity is a cover for the dropper. The package.json name (`chai-as-relay`) and author (hello@jsonspack.com) have no relationship to pino or its maintainers. A heavily obfuscated, multi-megabyte, self-executing blob wired into the require entry of a package that impersonates a top-tier logger has no legitimate purpose and gives whoever controls the payload arbitrary code execution on every installer that imports the package.\n","state":0,"publishedAt":"2026-09-26T15:14:59+00:00","modifiedAt":"2026-09-26T15:30:05.7503733+00:00","affected":[{"ecosystem":"npm","name":"chai-as-relay","ranges":[],"versions":["1.2.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/chai-as-relay/v/1.2.1"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17189","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17189","identifiers":["MAL-2026-17189"]},"retained":false,"historicalAffected":[]}],"coverage":[]}