MAL-2026-12540 Malicious code in chai-as-inspired (npm)

chai-as-inspired is a typosquat resembling chai/pino packages. Its middleware entrypoint (index.js) spawns a detached node lib/caller.js child on invocation. caller.js hides its network destination behind a fake process.env object whose values are base64 blobs; decoding yields the URL https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f and an x-secret-key header. The response's cookie field is passed to new Function.constructor('require', s)(require), executing attacker-controlled JavaScript in a retry loop with the installer's require and full Node privileges. The remote content is hosted on a mutable, anonymous JSON-storage bucket and can be changed at any time by the operator. The base64 disguise of the endpoint and header keys, combined with the fetch-and-eval mechanism, establishes hostile intent.