chai-as-type (npm) · Malicious Code
Affects chai-as-typeSource GCVE Database
Rated by Threat Radar
Data as of 8 Sep 2026, 09:08 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
npmchai-as-typepkg:npm/chai-as-typeOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should immediately remove the 'chai-as-type' package versions 7.0.5 and 1.1.9 from their projects and avoid installing or importing this package. Verify dependencies to ensure no indirect inclusion of this malicious package. Monitor for updates from trusted sources regarding remediation or package takedown.
Description
The npm package 'chai-as-type' is a malicious package impersonating popular assertion libraries. When imported, it downloads and executes attacker-controlled JavaScript code from a remote server, enabling arbitrary code execution in the Node.js environment. The package fetches payloads from mutable public JSON paste hosts, allowing the attacker to update the malicious code dynamically without republishing the package. This behavior can lead to credential theft, persistence, and other malicious activities. The malicious code is triggered either by invoking the exported middleware or running a specific npm script. The affected versions are 7.0.5 and 1.1.9.