npm · Malicious package advisory
Malwarechai-as-crack
GHSA-9q54-rq2g-8m87
Malicious code in chai-as-crack (npm)
Details
**Severity:** Critical
**Affected versions:** `= 7.0.5`
## Source: amazon-inspector (090c71f12df6d5441dce686e54fef42805f1afd6575d48bc0f6263dcf50b2f21)
Package's main entry (index.js) unconditionally requires./lib/config at top level, causing the file to execute on any require('chai-as-crack'). lib/config.js is approximately 4 MB of obfuscator.io-transformed code: a rotating string array of ~23,868 entries with hex-escaped identifiers, multiple decoder wrappers (T, j), and control-flow flattening. The exported middleware is a no-op decoy. Package metadata further disguises the module as the popular pino logger: package.json declares name chai-as-crack with keywords logger/stream/json, while README.md, docs/, index.d.ts, and LICENSE are copied verbatim from pino (linking to github.com/pinojs/pino). Author metadata (Robert King <[email protected]>, bugs URL https://jsonspack.com/issues) is unrelated to pino. The combination of import-time execution of an opaque multi-megabyte payload, heavy obfuscation with no source map or build artifacts, and a cover-story impersonating an unrelated well-known logger matches the loader/dropper shape and gives the publisher arbitrary code execution inside any consumer that imports the package.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/615d2f066ada956789997df338fdfc097388333d/osv/malicious/npm/chai-as-crack/MAL-2026-16196.json))
**References:**
- https://github.com/ossf/malicious-packages/blob/615d2f066ada956789997df338fdfc097388333d/osv/malicious/npm/chai-as-crack/MAL-2026-16196.json
- https://www.npmjs.com/package/chai-as-crack/v/7.0.5
- https://github.com/advisories/GHSA-9q54-rq2g-8m87Compromised versions (1)
- = 7.0.5
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.