MAL-2026-10055 Malicious code in chain-chai-async (npm)

[email protected] impersonates the pino logging library (README badge links to npm/pino, exports module.exports.pino = middleware, and ships files copied from the real pino source tree). Its exported middleware factory in index.js spawns lib/caller.js as a detached child node process with stdio ignored, decoupling the payload from the parent's lifecycle and suppressing its output. lib/caller.js issues an HTTPS GET to https://jsonkeeper.com/b/EXSIF, extracts the cookie field from the JSON response, and passes it to new Function.constructor('require', s)(require) — executing attacker-controlled JavaScript with full Node require access on any machine that loads and invokes the package. The remote source is a mutable, unauthenticated paste service, so the executed code can be swapped at any time by the attacker without republishing the package. Any consumer who installs this package believing it to be pino and calls its exported middleware will trigger arbitrary remote code execution on the host.