MAL-2026-5605 Malicious code in chai-as-victimed (npm)

Package name impersonates chai-as-promised but ships a remote-code dropper. lib/caller.js base64-decodes a hardcoded URL pointing to https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/a179ea35-b962-4722-b3f1-e28316d1a44a (an attacker-controlled mutable JSON store), issues a GET with a custom x-secret-key: _ header, takes the response's .cookie field, and executes it via new Function.constructor('require', s)(require) — granting the fetched code full Node privileges and require access. The URL, header name, and header value are stored base64-encoded under fake keys (DEV_API_KEY, DEV_SECRET_KEY, DEV_SECRET_VALUE) on a shadow process.env object to evade string scans. index.js spawns node lib/caller.js detached from the package's default export, so any consumer that loads and invokes the advertised middleware triggers arbitrary remote code execution on the installer's machine, retried up to 5 times. The README/keywords cosplay a logger (pino) while the package name targets users looking for chai-as-promised — neither matches the actual behavior.