취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (69e9bcacf8dca52aafe4d93019b888c6d32e344b500a21368f036bf586eee161)

chai-guid impersonates the pino logger and the chai-guid chai plugin (README copies pino badges and pinojs CI links; index.js exports middleware as module.exports.pino). When a consumer calls the exported middleware, index.js spawns lib/caller.js as a detached Node process with stdio ignored. lib/caller.js performs axios.get('https://jsonkeeper.com/b/U2BTS'), reads the .cookie field of the response, and executes it via new Function.constructor('require', s)(require) — running attacker-controlled JavaScript with full Node privileges and require injected. A second base64-encoded URL (https://jsonkeeper.com/b/XRGF3) is hidden in a fake process.env.DEV_API_KEY shim in lib/caller.js and lib/const.js as a secondary C2 endpoint. jsonkeeper.com is an anonymous, mutable JSON-paste host; whatever bytes the attacker pastes there will be executed on the installer's machine the moment any consumer invokes the package's middleware.