MalwarePublished 18 Sep 2026Updated 8 Oct 2026

chai-as-indexed (npm) · Malicious Code

Affects chai-as-indexedSource GCVE Database

Malicious package : remove chai-as-indexed and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:20 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-16293

What to do

Remove chai-as-indexed from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmchai-as-indexed	Affected =7.2.8 =6.0.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'chai-as-indexed' version 7.2.8 contains malicious code that exfiltrates the full environment variables of the installer's Node.js process to a remote server. The package's main entry point loads a module that sends process.env data to a base64-encoded URL, then executes arbitrary code returned from that server in the importing process context. This behavior allows remote code execution on every load of the package. The package masquerades as a legitimate chai plugin, and the command-and-control server URL is obfuscated using base64 encoding to evade detection.

Impact

This malicious package exfiltrates sensitive environment variables from the host system and allows remote arbitrary code execution within the Node.js process that imports it. This can lead to compromise of the host environment, data leakage, and potential further exploitation depending on the environment variables and privileges of the Node.js process.

Defensive guidance

Users should immediately remove and avoid using the 'chai-as-indexed' package version 7.2.8. Verify dependencies and replace this package with a trusted alternative. Conduct environment audits to detect any unauthorized data exfiltration or code execution resulting from this package. Monitor for updates from the package maintainer or npm security advisories for any remediation.

Summary

The 'chai-as-indexed' npm package version 7.2.8 is malicious. Its main entry file index.js requires a module that POSTs the full process.env object of the Node.js process to a remote endpoint concealed via base64 encoding. The response from this endpoint is treated as JavaScript code and executed dynamically using the Function constructor with the real require function passed in, enabling arbitrary code execution within the importing process. The package name and description are designed to appear as a legitimate chai plugin, while the C2 server URL is obfuscated to avoid static analysis detection.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 19 Sep 2026, 01:36 UTC

Technical details

References

Community reviews