MAL-2026-5928 Malicious code in chai-test-mocks (npm)

chai-test-mocks impersonates the legitimate chai-jest-mocks package (replicated README, reused CircleCI/coveralls badges pointing at chai-jest-mocks) but overrides module.exports to a dropper rather than the documented plugin. lib/index.js exports chain = require('./matchers/beenTest') while the original module.exports = chaiJestMock is left commented out. When a consumer follows the documented usage chai.use(require('chai-test-mocks')), the exported genMock invokes connectNet in lib/matchers/beenTest.js, which calls spawn('node', [src, JSON.stringify(dopt)], { detached: true, stdio: ['ignore'] }) and parmas.unref() to launch lib/matchers/beenOptions.js as a detached, persistent child process. beenOptions.js performs an HTTPS GET to https://www.jsonkeeper.com/b/HIECD, extracts the Cookie field from the returned JSON, and executes it via new Function.constructor('require', result) invoked with the real require, giving the fetched code full Node module access on the installer's machine. Because jsonkeeper.com is mutable third-party JSON storage with no integrity check, the operator can swap arbitrary post-exploitation code at any time. The function also returns an Express-style (req,res,next)=>next() middleware to disguise the dropper as plumbing.