chai-as-mno

GHSA-q3qf-2p3h-q5q9

Malicious code in chai-as-mno (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.5`

## Source: amazon-inspector (2e94e194f078c230d6c6b15efcddc54b133fd52c890a55b0f8bdb4c680452381)
The package name mimics `chai-as-promised` and its README, badges, and license text are copied from an unrelated project (`pino`), while the package.json description is unrelated boilerplate. The declared main `index.js` exports a trivial no-op Express middleware `(_req,_res,next)=>next()` and unconditionally executes `require('./lib/config')` at import time. `lib/config.js` is a ~4MB single-line file heavily obfuscated with an obfuscator.io string-array scheme (string array `d` of length 23971 with rotation, hex-named identifiers, nested decoder functions `j`/`T`, control-flow flattening, and ~40,000 inline-decoded strings). The visible surface API provides no legitimate reason to ship a multi-megabyte opaque blob as a `config` module, and merely requiring the package runs that payload in the installer's Node process. The combination of impersonation cover story, mismatched README/description, no-op public API, and an obfuscator.io-grade payload executed on `require` is the loader/dropper shape.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/72e5d8219b286d7332c4ad2364b87986138cf34c/osv/malicious/npm/chai-as-mno/MAL-2026-14427.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/72e5d8219b286d7332c4ad2364b87986138cf34c/osv/malicious/npm/chai-as-mno/MAL-2026-14427.json
- https://www.npmjs.com/package/chai-as-mno/v/1.0.5
- https://github.com/advisories/GHSA-q3qf-2p3h-q5q9

Compromised versions (1)

= 1.0.5

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.