Loading npm security reports…

chai-logger@3.0.2: Malicious npm security report (Block) | LPM Firewall

registry / chai-logger / 3.0.2

chai-logger@3.0.2

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Importing the package loads a large obfuscated top-level payload. It gains filesystem, process-spawning, synchronous command, cryptographic, and HTTP-client capabilities, but the concealed command and destination could not be safely established by static inspection.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer imports the package main entrypoint.

Impact

No confirmed attack was established, but hidden command execution and potential network behavior run during import and create unresolved risk.

Mechanism

index.js requires lib/query.js; that payload executes top-level setup and includes an obfuscated execSync fallback.

AI rationale

The package exposes concealed import-time process and network-capable behavior unrelated to its middleware export. No install lifecycle hook or confirmed malicious sink was found, so blocking is not justified.

Evidence

lib/query.js

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-16380

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in chai-logger (npm)

Details

The package presents itself as a Chai logging plugin but its main entry `index.js` requires `./lib/query.js`, a ~4 MB obfuscator.io-encoded module (23,868-entry rotated string array, T/j decoder wrappers, hex-property indirection) that executes at the top level as soon as the package is required. The remaining files under `lib/` (proto.js, levels.js, tools.js, etc.) are verbatim copies of pino source, unrelated to the advertised Chai plugin API — a cover story around the obfuscated blob. `package.json` declares `axios ^1.10.0` as a runtime dependency, and the only reference to axios in the shipped code is inside the obfuscated body of `lib/query.js`, giving the payload an HTTP client whose destination is reconstructed at runtime from the rotated string array. Author metadata points to `jsonspack.com`, unrelated to Chai or pino. The combination of import-time execution of a heavily obfuscated payload, a mismatched cover story, copied third-party source used as filler, and an HTTP client declared only for use inside the obfuscated code is the canonical npm credential/data-stealer shape.

Source & flagged code

7 flagged · loading source

index.jsView file

3const path = require('path'); L4: const { spawn } = require('child_process'); L5: const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

2L3: const path = require('path'); L4: const { spawn } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

lib/query.jsView file

1function mc(F,S,Y,E,i){const F9={F:0x1f1};return T(Y-F9.F,E);}function mk(F,S,Y,E,i){const FM={F:0x3dc};return T(i- -FM.F,F);}function ma(F,S,Y,E,i){const Fu={F:0x109};return j(i-F...

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/query.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js -> lib/query.js L1: function mc(F,S,Y,E,i){const F9={F:0x1f1};return T(Y-F9.F,E);}function mk(F,S,Y,E,i){const FM={F:0x3dc};return T(i- -FM.F,F);}function ma(F,S,Y,E,i){const Fu={F:0x109};return j(i-F...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/query.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/query.jsView on unpkg

lib/tools.jsView file

•matchType = malicious_source_fingerprint_signature signature = 918a45c5f0e59df5 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = chai-as-crack@7.0.5 matchedPath = lib/tools.js matchedIdentity = npm:Y2hhaS1hcy1jcmFjaw:7.0.5 similarity = 1.000 shingleOverlap = 12 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/tools.jsView on unpkg

package.jsonView file

5"main": "index.js", "scripts": { "smoke:pino": "node ./index.js", "smoke:file": "node ./file.js"

High

Ai Review Evidence

The declared main entrypoint imports lib/query.js during package import.

package.jsonView on unpkg · L5

Source & flagged code

7 flagged

index.jsView file

3const path = require('path'); L4: const { spawn } = require('child_process'); L5: const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

2L3: const path = require('path'); L4: const { spawn } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

lib/query.jsView file

1function mc(F,S,Y,E,i){const F9={F:0x1f1};return T(Y-F9.F,E);}function mk(F,S,Y,E,i){const FM={F:0x3dc};return T(i- -FM.F,F);}function ma(F,S,Y,E,i){const Fu={F:0x109};return j(i-F...

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/query.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js -> lib/query.js L1: function mc(F,S,Y,E,i){const F9={F:0x1f1};return T(Y-F9.F,E);}function mk(F,S,Y,E,i){const FM={F:0x3dc};return T(i- -FM.F,F);}function ma(F,S,Y,E,i){const Fu={F:0x109};return j(i-F...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/query.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/query.jsView on unpkg

lib/tools.jsView file

•matchType = malicious_source_fingerprint_signature signature = 918a45c5f0e59df5 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = chai-as-crack@7.0.5 matchedPath = lib/tools.js matchedIdentity = npm:Y2hhaS1hcy1jcmFjaw:7.0.5 similarity = 1.000 shingleOverlap = 12 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/tools.jsView on unpkg

package.jsonView file

5"main": "index.js", "scripts": { "smoke:pino": "node ./index.js", "smoke:file": "node ./file.js"

High

Ai Review Evidence

The declared main entrypoint imports lib/query.js during package import.

package.jsonView on unpkg · L5