MAL-2026-13446 Malicious code in express-chai (npm)

express-chai presents itself as an Express logger middleware impersonating pino, but its exported middleware factory invokes lib/caller.js which decodes a base64-obfuscated URL (https://gray-dyane-31.tiiny.site/index.json) stored in lib/const.js, fetches a JSON payload via axios with a base64-encoded dev-secret-key header, and passes the response's cookie field to new Function.constructor("require", s), then invokes the resulting function with the local require. This grants the operator of the anonymous tiiny.site host arbitrary code execution inside the installer's Node.js process at middleware setup time, with full access to require and the surrounding application context. The destination URL and secret header are base64-encoded rather than plain configuration, and the package's naming, keywords (fast, logger, stream, json), and pino-mirroring script names disguise a remote code loader as a well-known logging library.