MAL-2026-10040 Malicious code in chai-as-balanced (npm)

chai-as-balanced is a typosquat of chai-as-promised (also impersonating pino via README/badges/exports) that ships a remote code execution dropper. lib/const.js defines a fake process.env object whose DEV_API_KEY value is a base64-encoded URL to api.jsonstorage.net (an anonymous, attacker-mutable JSON storage service). lib/caller.js base64-decodes that URL, GETs the JSON blob using an obfuscated x-secret-key header, extracts the cookie field, and executes it via new Function.constructor('require', s)(require) — granting the fetched payload full Node privileges and access to the real require. index.js triggers this by spawning lib/caller.js as a detached, stdio-ignored child with child.unref(), so the dropper runs in the background and outlives the parent invocation, concealing execution from the caller. Because the payload source is anonymous and mutable, the executed code can change at any time without a new package release. Installers who mistype chai-as-promised as chai-as-balanced and invoke the exported middleware receive arbitrary attacker-controlled code execution.