chai-as-rendered@1.2.0
Vulnerability report · Last retrieved from osv.dev October 7, 2026 at 9:32 AM UTC
OSV ID
MAL-2026-12348
Ecosystem
npm
Summary
Typosquat of chai-as-promised. The package's exported middleware spawns a detached child process (lib/caller.js) that fetches a JSON payload from a base64-obfuscated jsonstorage.net URL (https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f) and evaluates the returned.cookie string via new Function.constructor("require", s)(require), giving the fetched code full require access on the installer's host. The remote URL and request headers are stored as base64 strings under fake process.env names (DEV_API_KEY, DEV_SECRET_KEY, DEV_SECRET_VALUE) and decoded with atob() at runtime to conceal the destination. The package name and keywords (fast, logger, stream, json) impersonate pino while the package name typosquats chai-as-promised.
Source: amazon-inspector (545ba2341881e666831e81156a815fdfac738830ec2918167e4c5fd3c42294bf)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.