Malicious code in chai-beta (npm)
The npm package chai-beta version 1.1.9 contains malicious code that downloads and executes a command-and-control (C2) dropper from a remote URL. This behavior is similar to previously observed malware in other npm packages such as chai-await-test. The package is identified as malicious and poses a risk if imported into projects.
AI Analysis
Technical Summary
The chai-beta npm package version 1.1.9 includes embedded malicious code that, upon import, downloads a C2 dropper payload from https://jsonkeeper[.]com/b/XRGF3 and executes it. This activity enables remote attackers to potentially control the affected system or execute arbitrary code. The malicious behavior is confirmed by Amazon Inspector and documented in the GCVE database under MAL-2026-2897 and GHSA-c6w2-3qw2-g5fm. No CVSS score or detailed impact metrics are provided, but the nature of the threat is consistent with malware distribution via a trusted package repository.
Potential Impact
If the malicious chai-beta package version 1.1.9 is imported and executed, it results in the download and execution of a C2 dropper, which can lead to remote code execution and potential system compromise. This undermines the integrity and security of the development environment and any systems running the affected code.
Mitigation Recommendations
Avoid using the chai-beta package version 1.1.9. Remove any existing installations of this package from your projects. Since no official patch or remediation is indicated, the best mitigation is to not use this package and to rely on trusted and verified dependencies. Monitor for updates from the package repository or security advisories for any official actions.
Malicious code in chai-beta (npm)
Description
The npm package chai-beta version 1.1.9 contains malicious code that downloads and executes a command-and-control (C2) dropper from a remote URL. This behavior is similar to previously observed malware in other npm packages such as chai-await-test. The package is identified as malicious and poses a risk if imported into projects.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The chai-beta npm package version 1.1.9 includes embedded malicious code that, upon import, downloads a C2 dropper payload from https://jsonkeeper[.]com/b/XRGF3 and executes it. This activity enables remote attackers to potentially control the affected system or execute arbitrary code. The malicious behavior is confirmed by Amazon Inspector and documented in the GCVE database under MAL-2026-2897 and GHSA-c6w2-3qw2-g5fm. No CVSS score or detailed impact metrics are provided, but the nature of the threat is consistent with malware distribution via a trusted package repository.
Potential Impact
If the malicious chai-beta package version 1.1.9 is imported and executed, it results in the download and execution of a C2 dropper, which can lead to remote code execution and potential system compromise. This undermines the integrity and security of the development environment and any systems running the affected code.
Defensive Guidance
Avoid using the chai-beta package version 1.1.9. Remove any existing installations of this package from your projects. Since no official patch or remediation is indicated, the best mitigation is to not use this package and to rely on trusted and verified dependencies. Monitor for updates from the package repository or security advisories for any official actions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-2897
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-c6w2-3qw2-g5fm"]
- Ecosystems
- ["npm"]
Threat ID: 6a96f319acd9273b49e4971d
Added to database: 09/01/2026, 15:45:29 UTC
Last enriched: 09/08/2026, 09:22:49 UTC
Last updated: 09/10/2026, 19:38:50 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.