chai-as-auth (npm) · Malicious Code
Affects chai-as-authSource GCVE Database
Malicious package : remove chai-as-auth and rotate any secrets on hosts that installed it.
Data as of 14 Jul 2026, 09:40 UTC
Malicious package
Published to npm · OSV MAL-2026-10518
What to do
Remove chai-as-auth from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmchai-as-auth | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'chai-as-auth' version 2.3.5 contains malicious code that exfiltrates environment variables to a remote server and executes arbitrary code received from that server. The package masquerades as a legitimate authentication library but includes a self-executing script that sends sensitive data such as AWS/GCP tokens, CI secrets, npm tokens, and database credentials to a hardcoded URL. The remote server response is executed with full Node.js require access, enabling further malicious payloads.