MAL-2026-17321 Malicious code in chaienv (npm)
Malicious package
Published
MAL-2026-17321 is a malicious package: chaienv (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-17321/ (Markdown: https://insights.sbomify.com/MAL-2026-17321/index.md)
- Package
- chaienv
- Registry
- npm
What is MAL-2026-17321?
MAL-2026-17321 is a malicious package in chaienv, published on 30 Sep 2026.
Official description
[email protected] is published as a small Chai environment helper, but its index.js unconditionally loads lib/config.js at require() time via
const { config } = require('./lib/config'). lib/config.js is a 4,454,290-byte single-line module packed with obfuscator.io (RC4-decoded string array of roughly 26,000 entries), with no relation to the trivial no-op middleware the README advertises. The rest of lib/ ships verbatim pino internals (proto.js, multistream.js, levels.js, transport.js, worker.js, redaction.js, symbols.js) as decoys, the README CI badge and LICENSE point at github.com/pinojs/pino, and package.json bugs.url is jsonspack.com — none of which match the stated Chai-plugin purpose. Any consumer that imports this package executes the opaque 4.4MB blob on load; the package impersonates an unrelated well-known project's source tree to normalize the obfuscated sibling and bypass casual review.What should I do about MAL-2026-17321?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.