registry / chai-as-crack / 7.0.5

chai-as-crack@7.0.5

This document describes the management of vulnerabilities for the project and all modules within the organization.

AI Security Review

scanned 23d ago · by lpm-firewall-ai

Importing the package loads a concealed, heavily obfuscated payload. That payload includes child-process and HTTP-client primitives not needed by the exported middleware.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Requiring or importing the package entry point.

Impact

It can execute concealed behavior in the consuming application's process, including command execution and network activity.

Mechanism

Import-time execution of an obfuscated command-and-network payload.

Attack narrative

A consumer imports index.js, which immediately loads lib/config.js. The exported middleware only calls next(), but the imported configuration file is a four-megabyte single-line obfuscated program containing child-process execution and axios primitives. This concealed import-time payload can run in the consumer process without a user action beyond normal package use.

AI rationale

The package disguises a large obfuscated command-and-network payload behind an inert middleware export and loads it at import time. Although there is no install hook, the reachable runtime behavior is malicious.

Evidence

index.jslib/config.js

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-16196

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in chai-as-crack (npm)

Package's main entry (index.js) unconditionally requires./lib/config at top level, causing the file to execute on any require('chai-as-crack'). lib/config.js is approximately 4 MB of obfuscator.io-transformed code: a rotating string array of ~23,868 entries with hex-escaped identifiers, multiple decoder wrappers (T, j), and control-flow flattening. The exported middleware is a no-op decoy. Package metadata further disguises the module as the popular pino logger: package.json declares name chai-as-crack with keywords logger/stream/json, while README.md, docs/, index.d.ts, and LICENSE are copied verbatim from pino (linking to github.com/pinojs/pino). Author metadata (Robert King <hello@jsonspack.com>, bugs URL https://jsonspack.com/issues) is unrelated to pino. The combination of import-time execution of an opaque multi-megabyte payload, heavy obfuscation with no source map or build artifacts, and a cover-story impersonating an unrelated well-known logger matches the loader/dropper shape and gives the publisher arbitrary code execution inside any consumer that imports the package.

chai-as-crack@7.0.5

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code