chai-logger

GHSA-fv5h-7hj3-xq5r

Malicious code in chai-logger (npm)

Details

**Severity:** Critical

**Affected versions:** `= 3.0.2`

## Source: amazon-inspector (566e54855d730e8555b93da4f8ea81faba72645079a7adcc3a05ea8bf8ad8ee6)
The package presents itself as a Chai logging plugin but its main entry `index.js` requires `./lib/query.js`, a ~4 MB obfuscator.io-encoded module (23,868-entry rotated string array, T/j decoder wrappers, hex-property indirection) that executes at the top level as soon as the package is required. The remaining files under `lib/` (proto.js, levels.js, tools.js, etc.) are verbatim copies of pino source, unrelated to the advertised Chai plugin API — a cover story around the obfuscated blob. `package.json` declares `axios ^1.10.0` as a runtime dependency, and the only reference to axios in the shipped code is inside the obfuscated body of `lib/query.js`, giving the payload an HTTP client whose destination is reconstructed at runtime from the rotated string array. Author metadata points to `jsonspack.com`, unrelated to Chai or pino. The combination of import-time execution of a heavily obfuscated payload, a mismatched cover story, copied third-party source used as filler, and an HTTP client declared only for use inside the obfuscated code is the canonical npm credential/data-stealer shape.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/93f5690fa3407c473772bcaade41b8b92c4b22bd/osv/malicious/npm/chai-logger/MAL-2026-16380.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/93f5690fa3407c473772bcaade41b8b92c4b22bd/osv/malicious/npm/chai-logger/MAL-2026-16380.json
- https://www.npmjs.com/package/chai-logger/v/3.0.2
- https://github.com/advisories/GHSA-fv5h-7hj3-xq5r

Compromised versions (1)

= 3.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.