Malicious code in chai-as-gateway (npm)

The 'chai-as-gateway' npm package version 7.1.5 is a malicious package that executes attacker-controlled code immediately upon being required. Its index.js imports a heavily obfuscated ~4MB script that includes functionality to execute child processes, perform HTTP requests via axios, and traverse filesystem directories to locate AWS credentials. The package's documentation is copied from a legitimate logger package (pinojs/pino), but the actual code is a no-op middleware combined with a hidden credential harvester and exfiltration mechanism. The author metadata is generic and suspicious. This package is a supply chain threat that compromises systems by stealing sensitive AWS credentials.

Systems that install and require this package will automatically execute malicious code that attempts to steal AWS credentials from the filesystem and exfiltrate them over the network. This can lead to unauthorized access to cloud resources and potential further compromise of the victim environment. The malicious behavior is triggered simply by importing the package, making it highly dangerous.

No official patch or remediation is documented. Users should immediately remove version 7.1.5 of 'chai-as-gateway' from their projects and avoid installing this package. Verify dependencies to ensure this package is not included transitively. Monitor for any unauthorized AWS access and rotate credentials if this package was used. Since this is a malicious package, the best mitigation is to avoid installation and remove it if present.