MalwarePublished 13 Jul 2026

chai-as-precision (npm) · Malicious Code

Affects chai-as-precisionSource GCVE Database

Malicious package : remove chai-as-precision and rotate any secrets on hosts that installed it.

Data as of 13 Jul 2026, 09:53 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10219

What to do

Remove chai-as-precision from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmchai-as-precision	Affected =7.0.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'chai-as-precision' version 7.0.6 contains malicious code that masquerades as a different package, 'pino'. When used, it spawns a detached child process that fetches and executes attacker-controlled JavaScript code from an external URL, allowing arbitrary code execution with full require access on the host. This behavior is hidden by suppressing output and using base64-encoded strings to obscure the malicious payload's origin and execution. There is no known patch or fix available at this time.

Impact

This malicious package enables arbitrary remote code execution on any system that installs and runs it, potentially allowing attackers to execute any code with the privileges of the Node.js process. This can lead to full system compromise, data theft, or further malware deployment. The attacker controls the external payload, which can be changed at any time, making the threat persistent and dynamic.

Defensive guidance

Users should immediately remove the 'chai-as-precision' package version 7.0.6 from their projects and dependency trees. Avoid installing or using this package. Verify your dependency manifests and lockfiles for the presence of this package and replace it with trusted alternatives. Monitor for any unexpected child processes or network connections originating from Node.js applications. Check vendor advisories or trusted security sources for updates on remediation.

Summary

The 'chai-as-precision' npm package version 7.0.6 is a malicious package that mimics the 'pino' logging library, likely as a typosquatting attempt. Its main module spawns a detached child Node.js process that fetches a JSON payload from an attacker-controlled URL (hosted on tiiny.site). The payload contains a 'cookie' field with JavaScript code that is executed dynamically via the Function constructor, granting the attacker arbitrary code execution capabilities with full access to Node.js require functionality on the host system. The malicious code uses obfuscation techniques such as base64 encoding and environment variable wrappers to evade detection.

References

npmjs.com/package/chai-as-precision/v/7.0.6 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Jul 2026, 09:53 UTC

Technical details

References

Community reviews