OpenSSF/OSV advisory MAL-2026-6497 confirms this npm version as malicious. Package name 'chai-as-synced' impersonates the well-known 'chai-as-promised'. On require, index.js spawns a detached, stdio-ignored Node child running lib/initializeCaller.js. That script decodes a base64-obfuscated URL (https://amethyst-lorrin-26.tiiny.site/index.json) and an 'x-secret-key' header literal stored inside a fake local process.env object, performs an HTTPS GET to that anonymous static-hosting endpoint,...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in chai-as-synced (npm)
Details
Package name 'chai-as-synced' impersonates the well-known 'chai-as-promised'. On require, index.js spawns a detached, stdio-ignored Node child running lib/initializeCaller.js. That script decodes a base64-obfuscated URL (https://amethyst-lorrin-26.tiiny.site/index.json) and an 'x-secret-key' header literal stored inside a fake local process.env object, performs an HTTPS GET to that anonymous static-hosting endpoint, and passes the returned 'cookie' field to new Function.constructor(...) invoked with require injected, retried up to 5 times. The fetched JavaScript runs in the installer's Node process with full require access. The destination obfuscation, detached/unref'd child, and hidden stdio together indicate a covert loader; the declared dependencies (sqlite3, request, axios) and package keywords do not match the advertised purpose.
Decision reason
OpenSSF Malicious Packages via OSV confirms chai-as-synced@6.0.3 as malicious (MAL-2026-6497): Malicious code in chai-as-synced (npm)