Malicious code in chai-as-sleek (npm)
Affects chai-as-sleekSource GCVE Database
Rated by Threat Radar
Data as of 09/09/2026, 13:54:45 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmchai-as-sleek | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should avoid using 'chai-as-sleek' version 7.1.2 and remove it from their dependencies. Verify the authenticity of packages before installation and prefer official, well-maintained libraries. Monitor for updates or advisories from the package repository or security vendors regarding this threat.
Description
The npm package 'chai-as-sleek' version 7.1.2 impersonates the legitimate pino logger by copying its README, LICENSE, and other files. It contains a large obfuscated JavaScript payload that executes immediately upon import, which includes hidden HTTP client usage via axios. This malicious code can perform outbound HTTP requests without the user's knowledge, posing a risk of unauthorized network activity.
Impact
Any project importing 'chai-as-sleek' version 7.1.2 will execute the obfuscated malicious payload immediately, which can perform unauthorized outbound HTTP requests. This can lead to data exfiltration, command and control communication, or other malicious network activity, compromising the security and integrity of the affected environment.
Summary
The 'chai-as-sleek' npm package version 7.1.2 is a malicious package that mimics the pino logger to deceive users. Its main entry point loads an obfuscated ~4MB JavaScript blob that executes at require() time. Although axios is declared as a dependency, it is only used within this obfuscated code to enable outbound HTTP requests. This hidden payload can run arbitrary code and communicate externally, representing a supply chain threat when the package is imported.