registry / express-chai / 3.7.9

express-chai@3.7.9

This document describes the management of vulnerabilities for the project and all modules within the organization.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Runtime use of the exported middleware fetches attacker-controlled JavaScript and executes it in the host Node process. This is remote code execution, not a legitimate express/chai feature.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Import the package and invoke its exported middleware.

Impact

Remote code runs with the consuming application's Node.js privileges.

Mechanism

Remote payload fetch followed by dynamic Function execution.

Attack narrative

The middleware calls lib/caller.js at runtime. That module decodes a hard-coded URL, downloads the cookie field from the response with a fixed header, and passes it to a Function constructor with require available. The endpoint operator can therefore execute arbitrary Node.js code in every application that invokes the middleware.

Rationale

Direct source inspection confirms an externally controlled payload is dynamically executed. The lack of install hooks does not mitigate runtime remote code execution.

Evidence

package.jsonindex.jslib/caller.jslib/const.js

Network endpoints1

gray-dyane-31.tiiny.site/index.json

OSV Corroboration

OpenSSF/OSV

express-chai presents itself as an Express logger middleware impersonating pino, but its exported middleware factory invokes lib/caller.js which decodes a base64-obfuscated URL (https://gray-dyane-31.tiiny.site/index.json) stored in lib/const.js, fetches a JSON payload via axios with a base64-encoded `dev-secret-key` header, and passes the response's `cookie` field to `new Function.constructor("require", s)`, then invokes the resulting function with the local `require`. This grants the operator of the anonymous tiiny.site host arbitrary code execution inside the installer's Node.js process at middleware setup time, with full access to `require` and the surrounding application context. The destination URL and secret header are base64-encoded rather than plain configuration, and the package's naming, keywords (fast, logger, stream, json), and pino-mirroring script names disguise a remote code loader as a well-known logging library.

express-chai@3.7.9

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code