{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "lib/config.js",
              "sha256": "cc93ac7310b3a044badfc17f112a763bb24452ca88236892a470fdd362a9af36",
              "tlsh": "8626a5c8494ae06389de26d37e0639d9e33b5d66d4eca5a7c66cbc9c6cbc447c0a1cd0"
            },
            {
              "path": "package.json",
              "sha256": "37af31772ae215ad9ab85f2f37a7c46cbec4bb7b0a10ae13b7b4f19b84778a84",
              "tlsh": "2a017620deb88e2300ed25924c2a0643ba714c479529fd2933dba12c4fad9bb01bf21d"
            }
          ],
          "package_integrity": [
            {
              "filename": "chai-as-relay-1.2.1.tgz",
              "hashes": {
                "sha1": "b78835bcec5b368ed0695706aa6eb15ab0c80a1b",
                "sha512_sri": "sha512-Gzsi2w4ZEctlgEoQLU5pWM9oD/wKesHwq0uy3SC8wKcvJoLHFcvzvhtAAdQwqueChEII6ZTkaqQYE3XKY2h51Q=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "chai-as-relay"
      },
      "versions": [
        "1.2.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-020563",
        "import_time": "2026-09-26T15:16:15.775157869Z",
        "modified_time": "2026-09-26T15:14:59Z",
        "sha256": "5c65319b0e17f945fc57f482eb174e5d7fe70e63a380cb24f64eea1808bdad2f",
        "source": "amazon-inspector",
        "versions": [
          "1.2.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5c65319b0e17f945fc57f482eb174e5d7fe70e63a380cb24f64eea1808bdad2f)\nPackage main index.js unconditionally requires./lib/config at module load. lib/config.js is a single-line ~4.4MB obfuscator.io-packed IIFE (hex-escaped string-array of 26,102 entries, rotated with wrapper decoders, control-flow flattening, ~133k transform changes) that self-invokes at top level. Any consumer that `require(\u0027chai-as-relay\u0027)` executes this opaque bundle in-process. The remainder of the tarball (README, LICENSE, index.d.ts, lib/proto, etc.) is copied verbatim from the legitimate `pino` logger project, and index.js additionally exports a no-op Express-style middleware \u2014 the package\u0027s advertised identity is a cover for the dropper. The package.json name (`chai-as-relay`) and author (hello@jsonspack.com) have no relationship to pino or its maintainers. A heavily obfuscated, multi-megabyte, self-executing blob wired into the require entry of a package that impersonates a top-tier logger has no legitimate purpose and gives whoever controls the payload arbitrary code execution on every installer that imports the package.\n",
  "id": "MAL-2026-17189",
  "modified": "2026-09-26T15:14:59Z",
  "published": "2026-09-26T15:14:59Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/chai-as-relay/v/1.2.1"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in chai-as-relay (npm)"
}