MalwarePublished 5 Aug 2026

chai-assertions-plus (npm) · Malicious Code

Affects chai-assertions-plusSource GCVE Database

Malicious package : remove chai-assertions-plus and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 17:06 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12349

What to do

Remove chai-assertions-plus from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmchai-assertions-plus	Affected =6.0.6 =6.0.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package chai-assertions-plus, published as a Chai assertions extension, contains malicious code that executes arbitrary code on the installer's machine. The package's code replaces the global process object with a fake one containing base64-encoded data that reconstructs a URL and HTTP header. At runtime, it fetches code from this URL and executes it using the Node.js require function. This behavior occurs on every import of the module, indicating deliberate deception. Versions 6.0.5 and 6.0.6 are affected. No CVSS score is available.

Impact

This malicious package enables arbitrary code execution on any system that installs and imports it, potentially allowing attackers to execute any code with the privileges of the user running the Node.js process. This can lead to system compromise, data theft, or further malware deployment. The attack is triggered automatically on import, increasing risk of unnoticed exploitation.

Defensive guidance

Users should immediately avoid installing or importing chai-assertions-plus versions 6.0.5 and 6.0.6. Remove the package from existing projects and replace it with a trusted alternative. Monitor for any unexpected network requests or code execution related to this package. Check vendor advisories or npm security advisories for updates or official guidance.

Summary

The npm package chai-assertions-plus masquerades as a Chai assertions extension but contains unrelated filler code and a malicious payload. Upon requiring the package, a top-level immediately invoked function expression (IIFE) shadows the global process object with a fake object whose environment fields hold base64-encoded strings. These strings decode at runtime to form a destination URL and an HTTP header. The package performs an axios GET request to this URL, then executes the returned response body as code via new Function("require", response), passing the real require function. This allows arbitrary code execution with the package's require capability on the user's machine every time the module is imported. The mismatch between the package name/description and the code, as well as the obfuscated endpoint and headers, indicate intentional malicious behavior rather than misconfiguration.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 17:06 UTC

Technical details

References

Community reviews