0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
chai-as-const
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting chai-as-const, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-7008 | Unknown | Malicious code in chai-as-const (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f2c70991a87f00f1b25b85243d1984fcb2562dc2c34f0c5514827b3660350294) chai-as-const@1.4.5 is a disguised dropper. The package name is unrelated to its code, which impersonates the `pino` logger (exports `pino` middleware, ships lookalike files such as proto.js, redaction.js, transport.js, multistream.js). On first invocation of the exported middleware, index.js spawns a detached background task in lib/initializeCaller.js that (1) base64-decodes a hardcoded endpoint (https://ipcheck-hashed.vercel.app/api/auth/ |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f2c70991a87f00f1b25b85243d1984fcb2562dc2c34f0c5514827b3660350294) chai-as-const@1.4.5 is a disguised dropper. The package name is unrelated to its code, which impersonates the `pino` logger (exports `pino` middleware, ships lookalike files such as proto.js, redaction.js, transport.js, multistream.js). On first invocation of the exported middleware, index.js spawns a detached background task in lib/initializeCaller.js that (1) base64-decodes a hardcoded endpoint (https://ipcheck-hashed.vercel.app/api/auth/