MalwarePublished 13 Jul 2026

chai-as-verified (npm) · Malicious Code

Affects chai-as-verifiedSource GCVE Database

Malicious package : remove chai-as-verified and rotate any secrets on hosts that installed it.

Data as of 14 Jul 2026, 09:47 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10504

What to do

Remove chai-as-verified from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmchai-as-verified	Affected =7.1.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'chai-as-verified' version 7.1.5 is identified as malicious. It masquerades as a legitimate package similar to 'chai-as-promised' but contains code that spawns a detached Node.js child process. This process fetches and executes remote JavaScript code from a hidden command-and-control (C2) server, granting the attacker full access to Node.js require functionality. The C2 URL and related headers are base64-encoded to evade static detection.

Impact

This malicious package enables remote code execution within the Node.js environment where it is installed. The attacker can run arbitrary code with the privileges of the Node.js process, potentially leading to full system compromise, data exfiltration, or further malicious activity. Because the payload is fetched and executed dynamically, the attacker can change the behavior at will after installation.

Defensive guidance

Users should immediately remove the 'chai-as-verified' package version 7.1.5 from their projects and replace it with the legitimate 'chai-as-promised' package or other trusted alternatives. Review dependencies for typosquatting or suspicious packages before installation. Monitor for any unexpected child processes or network connections originating from Node.js processes.

Summary

The 'chai-as-verified' package version 7.1.5 is a typosquatting malicious package that, upon being required, executes a middleware function spawning a detached Node.js child process. This child process retrieves a JavaScript payload from a base64-encoded URL stored in environment variables, using a base64-decoded secret header for authentication. The payload is executed dynamically with full Node.js require access, enabling arbitrary code execution. The use of base64 encoding for the C2 URL and headers is intended to evade static analysis detection.

References

npmjs.com/package/chai-as-verified/v/7.1.5 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:47 UTC

Technical details

References

Community reviews