VulnerabilityPublished 15 Apr 2026Updated 1 Sep 2026

chai-as-adapter (npm) · Malicious Code

Affects chai-as-adapterSource GCVE Database

Severity

High

Rated by Threat Radar

Data as of 8 Sep 2026, 08:53 UTC

What to do

Affected software

Product	Affected	Fixed in
npmchai-as-adapter	Affected =1.5.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

The best mitigation is to avoid using the chai-as-adapter package version 1.5.2. Users should remove this package from their projects and replace it with trusted alternatives. Monitor official advisories for updates or patches.

Description

The npm package chai-as-adapter version 1.5.2 contains malicious code that downloads and executes a command-and-control (C2) dropper from a remote URL. This behavior is similar to previously observed malware in related packages. No official patch or remediation guidance is currently provided.

Impact

Users who install and import chai-as-adapter version 1.5.2 risk executing malicious code that could lead to system compromise or unauthorized remote control. The malicious payload is a dropper that may facilitate further malware deployment or data exfiltration. No direct evidence of exploitation in the wild is currently known.

Summary

The npm package chai-as-adapter version 1.5.2 is identified as malicious. When imported, it downloads a C2 dropper from https://jsonkeeper[.]com/b/FAWPU and executes it, enabling potential remote control or further malicious activity. This package is part of the npm ecosystem and has been flagged by Amazon Inspector and the GCVE database. There is no CVSS score or detailed vendor advisory available, and no known exploits in the wild have been reported.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Sep 2026, 08:53 UTC

Technical details

References

Community reviews