{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "lib/initializeCaller.js",
              "sha256": "c228e2f20e0dec3cf4e151033fdb13715c2f43975ee5ccf58caf059e104a5266",
              "tlsh": "6911cc8d61fd201c056652e6b62f18126022e4673d86d4e47acc83471fe526fbd536df"
            },
            {
              "path": "index.js",
              "sha256": "1f51184c197102444a2c8a23e4a8e54a6479750420512922fcb5d5f795c33911",
              "tlsh": "0f318545b5f21259126d98c4f6b4a5263cdf9437331b76b1cded93952bce2080032bc7"
            }
          ],
          "package_integrity": [
            {
              "filename": "chainix-4.4.5.tgz",
              "hashes": {
                "sha1": "aa3bc8462f06f0afde8515dbcdc24eaa3b35d5c9",
                "sha512_sri": "sha512-DzwOkPWMChQDzEpCc3Z5os7a7NYJG2SrzZyZeGmhTDOJVDfV3t9bGh3G0eqHT5ypw/wd37sNg3bEyZ2seHccPQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "chainix"
      },
      "versions": [
        "4.4.5"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-004919",
        "import_time": "2026-05-26T15:07:42.801096833Z",
        "modified_time": "2026-05-26T14:34:56Z",
        "sha256": "93d9609d2eac0c0ff33aed557171138930255798aa649fa648b04814c8cb1908",
        "source": "amazon-inspector",
        "versions": [
          "4.4.5"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (93d9609d2eac0c0ff33aed557171138930255798aa649fa648b04814c8cb1908)\nPackage presents itself as a pino-compatible logger (README badges link to pinojs/pino, exports alias `module.exports.pino = middleware`) but its exported middleware spawns a detached `node lib/initializeCaller.js`. That script base64-decodes a hardcoded URL to https://aqua-margit-84.tiiny.site/index.json, fetches the JSON over HTTPS with a base64-obfuscated `x-secret-key` header, takes the `data.cookie` field, and executes it via `new Function.constructor(\"require\", response)(require)` \u2014 compiling and running attacker-controlled JavaScript with full Node `require` access. The fetch retries 5 times. The C2 URL and header name/value are stored as base64 in a fake `process` object to evade plain-text scanning. tiiny.site is an anonymous static-hosting service; the content at that URL is mutable and attacker-controlled. This is a remote-code-execution dropper that fires when a consumer application invokes the advertised middleware, giving the attacker arbitrary code execution on any host running the application.\n",
  "id": "MAL-2026-4817",
  "modified": "2026-05-26T14:34:56Z",
  "published": "2026-05-26T14:34:56Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/chainix/v/4.4.5"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in chainix (npm)"
}