Malicious code in chai-await-dom (npm)
MAL-2026-10049 · GHSA-5368-rr57-2vg7
Published · Modified
Dependency scanning
Check whether chai-await-dom is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
__
Source: amazon-inspector (e78d8b4da2e781df4437569123ba3913c3f0135bbef66addaa5766a109fdd98b)
The package impersonates a pino-style logger API but its exported middleware spawns a detached Node child process that runs lib/caller.js. caller.js retrieves a JavaScript payload from https://jsonkeeper.com/b/BPB86 (an anonymous paste-style host) and executes it in-process via new Function.constructor('require', s)(require), granting the remote host arbitrary code execution with the installer's Node privileges. lib/const.js stores a base64-encoded sibling URL (https://jsonkeeper.com/b/ZK45J decoded from aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1pLNDVK), deliberately obfuscating the C2 destination. The package name (chai-await-dom) does not match its actual behavior or its impersonated logger API surface, consistent with a namespace-abuse lure carrying a remote-code-execution payload.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes