chai-beta (npm) · Malicious Code

The npm package chai-beta version 1.1.9 contains malicious code that downloads and executes a command-and-control (C2) dropper from a remote URL. This behavior is similar to previously observed malware in other npm packages such as chai-await-test. The package is identified as malicious and poses a risk if imported into projects.

• indece.com/en-US/blog/7df041ba-feb1-4d87-918b-7fc2c709d805 (opens in a new tab)
• sonatype.com/blog/lazarus-groups-latest-brandjacking-campaign-on-npm (opens in a new tab)
• github.com/advisories/GHSA-c6w2-3qw2-g5fm (opens in a new tab)