Malicious code in chai-as-sleek (npm)
The npm package 'chai-as-sleek' version 7.1.2 impersonates the legitimate pino logger by copying its README, LICENSE, and other files. It contains a large obfuscated JavaScript payload that executes immediately upon import, which includes hidden HTTP client usage via axios. This malicious code can perform outbound HTTP requests without the user's knowledge, posing a risk of unauthorized network activity.
AI Analysis
Technical Summary
The 'chai-as-sleek' npm package version 7.1.2 is a malicious package that mimics the pino logger to deceive users. Its main entry point loads an obfuscated ~4MB JavaScript blob that executes at require() time. Although axios is declared as a dependency, it is only used within this obfuscated code to enable outbound HTTP requests. This hidden payload can run arbitrary code and communicate externally, representing a supply chain threat when the package is imported.
Potential Impact
Any project importing 'chai-as-sleek' version 7.1.2 will execute the obfuscated malicious payload immediately, which can perform unauthorized outbound HTTP requests. This can lead to data exfiltration, command and control communication, or other malicious network activity, compromising the security and integrity of the affected environment.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid using 'chai-as-sleek' version 7.1.2 and remove it from their dependencies. Verify the authenticity of packages before installation and prefer official, well-maintained libraries. Monitor for updates or advisories from the package repository or security vendors regarding this threat.
Malicious code in chai-as-sleek (npm)
Description
The npm package 'chai-as-sleek' version 7.1.2 impersonates the legitimate pino logger by copying its README, LICENSE, and other files. It contains a large obfuscated JavaScript payload that executes immediately upon import, which includes hidden HTTP client usage via axios. This malicious code can perform outbound HTTP requests without the user's knowledge, posing a risk of unauthorized network activity.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'chai-as-sleek' npm package version 7.1.2 is a malicious package that mimics the pino logger to deceive users. Its main entry point loads an obfuscated ~4MB JavaScript blob that executes at require() time. Although axios is declared as a dependency, it is only used within this obfuscated code to enable outbound HTTP requests. This hidden payload can run arbitrary code and communicate externally, representing a supply chain threat when the package is imported.
Potential Impact
Any project importing 'chai-as-sleek' version 7.1.2 will execute the obfuscated malicious payload immediately, which can perform unauthorized outbound HTTP requests. This can lead to data exfiltration, command and control communication, or other malicious network activity, compromising the security and integrity of the affected environment.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid using 'chai-as-sleek' version 7.1.2 and remove it from their dependencies. Verify the authenticity of packages before installation and prefer official, well-maintained libraries. Monitor for updates or advisories from the package repository or security vendors regarding this threat.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-16077
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6aa15f73acd9273b496181e3
Added to database: 09/09/2026, 13:30:27 UTC
Last enriched: 09/09/2026, 13:54:45 UTC
Last updated: 09/09/2026, 23:18:15 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.