MAL-2026-14533 Malicious code in chai-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b91b222013b099c570003ced5265988a19121921b071ee183cdbe304e2b020d9 On require'chai-plus', a top-level IIFE in lib/index.js unconditionally invokes Bootstrap.execute, which spawns npm install -g [email protected] an...

Malicious code in chai-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b91b222013b099c570003ced5265988a19121921b071ee183cdbe304e2b020d9 On require'chai-plus', a top-level IIFE in lib/index.js unconditionally invokes Bootstrap.execute, which spawns npm install -g [email protected] an...

Malicious code in chai-as-mno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e94e194f078c230d6c6b15efcddc54b133fd52c890a55b0f8bdb4c680452381 The package name mimics chai-as-promised and its README, badges, and license text are copied from an unrelated project pino, while the package.json...

Malicious code in chai-as-soul (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 244e923b668eb903bcc217cb1eda26ce2227f37bd14abc3699d60c222c4f4e62 [email protected] is a typosquat/repackage of pino: LICENSE, README, docs, and lib/ are copied from pinojs/pino, package.json description is unrelat...

Malicious code in chai-as-reformed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae73388f2a877d421e53b37bdd36496a8048149ffe2e64a975e87c705f8b0e45 The package impersonates chai-as-promised and copies its README from pino, but its exported middleware spawns a detached node lib/caller.js process...

Malicious code in chai-as-deployer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4da130c2818dc609c23c93511a70a6c207cf19cdf9fdd937e369e07b5f1e492 The package is published as chai-as-deployer but its tarball contains verbatim pino README/docs/type-definitions while the advertised chai plugin is ...

MAL-2026-13700 Malicious code in chai-as-deployer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4da130c2818dc609c23c93511a70a6c207cf19cdf9fdd937e369e07b5f1e492 The package is published as chai-as-deployer but its tarball contains verbatim pino README/docs/type-definitions while the advertised chai plugin is ...

Malicious code in chai-foundry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94e40493af5310c6ee769911bff65e55538911ae3f286fba2a3474f9f8a38940 [email protected] is a trojan package presenting itself as a chai plugin README shows chai.usechaiLeaf while its badges, documentation, and internal...

MAL-2026-13356 Malicious code in chai-foundry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94e40493af5310c6ee769911bff65e55538911ae3f286fba2a3474f9f8a38940 [email protected] is a trojan package presenting itself as a chai plugin README shows chai.usechaiLeaf while its badges, documentation, and internal...

MAL-2026-12540 Malicious code in chai-as-inspired (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc4795830ed2849aaf2a6eaa488fbecc42a31c2d6d212fe34e635c16217e46ed chai-as-inspired is a typosquat resembling chai/pino packages. Its middleware entrypoint index.js spawns a detached node lib/caller.js child on...

Malicious code in chai-assertions-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80a83cd9353779d12538e8c6b06276178f6f0c246abd7d5148ce805536cbf57f The package is published as a Chai assertions extension, but the shipped code in index.js and lib/ is unrelated Pino logger source used as filler...

Malicious code in chai-as-stringify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77eb9f214b2dc10f13ecfd3239542bc27fb35bdd5d0a645b41b398d8a4a3965d [email protected] is a typosquat of chai-as-promised. The tarball ships lib/config/config.env, a 4MB heavily obfuscated JavaScript payload usin...

MAL-2026-11032 Malicious code in chai-as-stringify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77eb9f214b2dc10f13ecfd3239542bc27fb35bdd5d0a645b41b398d8a4a3965d [email protected] is a typosquat of chai-as-promised. The tarball ships lib/config/config.env, a 4MB heavily obfuscated JavaScript payload usin...

Malicious code in chai-leaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77cc7562a27df348fafc455124fd845dfc2e5774c42279ee6e3dd8f1cfb1f05b [email protected]'s main entry index.js unconditionally requires./lib/config, which is a single 3,546,568-byte obfuscator.io-encoded file 20,721-entry...

MAL-2026-10940 Malicious code in chai-leaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77cc7562a27df348fafc455124fd845dfc2e5774c42279ee6e3dd8f1cfb1f05b [email protected]'s main entry index.js unconditionally requires./lib/config, which is a single 3,546,568-byte obfuscator.io-encoded file 20,721-entry...

MAL-2026-10939 Malicious code in chai-as-reddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eff17b9d2536e662413c5c7090a1611f8c2813033a03960f9d979f23f2f72e7 The npm package [email protected] is a trojaned distribution. Its published metadata and README describe a Chai plugin for Reddit API assertions,...

Malicious code in chai-as-reddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eff17b9d2536e662413c5c7090a1611f8c2813033a03960f9d979f23f2f72e7 The npm package [email protected] is a trojaned distribution. Its published metadata and README describe a Chai plugin for Reddit API assertions,...

MAL-2026-10671 Malicious code in spytrack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72113145e88d53764f1e157c91cda05cb143a31802d9565ba8e1765e9886491b spytrack is a typosquat of chai-spies. When the plugin is registered via chai.use, the top-level plugin function invokes assertConnection, which...

MAL-2026-10630 Malicious code in chai-as-byte (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6820ba756fd8d2eb81435c478feb269e34f2aea859e42b42861d0a28f914a1f On require of the package's main entry, index.js detaches a child process that runs lib/initializeCaller.js. That script posts the caller's entire...

Malicious code in chai-as-structured (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9508b72d48575443d9e68f1da1ef6bdd1ebc9351f271fba56b563701f03e56e2 The package name evokes chai-as-promised but the shipped code presents itself as pino middleware. When the middleware factory in index.js is invoked,...