MalwarePublished 9 Jul 2026Updated 18 Sep 2026

chai-as-buffered (npm) · Malicious Code

Affects chai-as-bufferedSource GCVE Database

Malicious package : remove chai-as-buffered and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10041

What to do

Remove chai-as-buffered from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmchai-as-buffered	Affected =3.7.24 =7.2.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package chai-as-buffered@3.7.24 is a malicious typosquat of chai-as-promised. It impersonates the pino logger and contains code that downloads and executes attacker-controlled JavaScript code with full require access on the host machine. This allows arbitrary code execution whenever the package is loaded.

Impact

This malicious package enables remote attackers to execute arbitrary code on the victim's machine with full access to Node.js require functionality. The attacker can change the payload at any time by modifying the JSON document at the command-and-control URL, leading to persistent and dynamic compromise of affected environments.

Defensive guidance

Users should immediately remove chai-as-buffered@3.7.24 from their dependencies and avoid installing similarly named typosquat packages. Verify package authenticity before installation. Monitor for suspicious child processes spawned by Node.js and network connections to unknown third-party storage URLs. Since this is a malicious package, remediation involves removal and dependency hygiene.

Summary

The package chai-as-buffered@3.7.24 is a typosquatting lure that mimics chai-as-promised. Its lib/caller.js file shadows the process object to hide base64-encoded constants for a command-and-control URL and HTTP header details. When the package middleware is invoked, it decodes the hidden URL, spawns a detached child process, fetches a JSON document from an attacker-controlled mutable third-party storage, and executes the JavaScript code contained in the document's cookie field using Function.constructor with live require access. This results in arbitrary code execution on any environment that loads this package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 19:16 UTC

Technical details

References

Community reviews