MAL-2026-16077 Malicious code in chai-as-sleek (npm)
Malicious package
Published
MAL-2026-16077 is a malicious package: chai-as-sleek (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-16077/ (Markdown: https://insights.sbomify.com/MAL-2026-16077/index.md)
- Package
- chai-as-sleek
- Registry
- npm
What is MAL-2026-16077?
MAL-2026-16077 is a malicious package in chai-as-sleek, published on 9 Sep 2026.
Official description
Package published as 'chai-as-sleek' impersonates the pino logger: README, LICENSE, docs/, and index.d.ts are copied verbatim from pino, while package.json description reads 'This document describes the management of vulnerabilities…' and the README also markets the package as a chai plugin. The main entrypoint index.js unconditionally executes
require('./lib/config') at load time. lib/config.js is a single ~4 MB line of obfuscator.io-obfuscated JavaScript (23,868-entry rotated string array, decoder functions T and j, control-flow flattening, ~20k decoder-wrapper calls) with no configuration content. package.json declares axios ^1.10.0 as a runtime dependency, but no readable source file imports axios — the only reachable consumer of the HTTP client is the opaque blob in lib/config.js. Any consumer that imports 'chai-as-sleek' executes this hidden payload at require() time with outbound HTTP capability provisioned.What should I do about MAL-2026-16077?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.