chai-as-deployer (npm) · Malicious Code
Affects chai-as-deployerSource GCVE Database
Malicious package : remove chai-as-deployer and rotate any secrets on hosts that installed it.
Data as of 26 Oct 2026, 16:15 UTC
Malicious package
Published to npm · OSV MAL-2026-13700
What to do
Remove chai-as-deployer from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmchai-as-deployer | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'chai-as-deployer' is a malicious package that impersonates a legitimate chai plugin but contains a heavily obfuscated payload. This payload executes automatically upon import and includes code to run child processes and make outbound HTTP requests, indicating it acts as a stealer or loader. The package provides no legitimate functionality and is designed to compromise any system that installs or runs it.
References
- npmjs.com/package/chai-as-deployer/v/2.3.6 (opens in a new tab)
- npmjs.com/package/chai-as-deployer/v/2.3.5 (opens in a new tab)
- github.com/advisories/GHSA-6q3r-v92v-89p4 (opens in a new tab)
- github.com/advisories/GHSA-7qqp-m577-rp2w (opens in a new tab)
- security.snyk.io/vuln/SNYK-JS-CHAIASDEPLOYER-18609744 (opens in a new tab)