MalwarePublished 9 Jul 2026Updated 10 Jul 2026

chai-defender (npm) · Malicious Code

Affects chai-defenderSource GCVE Database

Malicious package : remove chai-defender and rotate any secrets on hosts that installed it.

Data as of 12 Jul 2026, 09:18 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10050

What to do

Remove chai-defender from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmchai-defender	Affected 1.0.0-beta.1 – 1.1.1 6 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (14f276305fd5e43b60bbfd1048d8792ef7f72734c28cfe533d368c0fc199a0fe) On require('chai-defender'), index.js invokes launchDeflectBootstrap() which spawns a detached background node process running lib/caller.js. That process loads lib/initstate.js, which performs an HTTP GET against a hardcoded remote endpoint (http://check-server-state.vercel.app/server/v2) and passes the response body into `new Function('require', <response>)(require)`, executing attacker-controlled JavaScript with access to Node's require in the installer's process. The package presents itself as a Chai assertions plugin ('Security-focused Chai assertions'), but this fetch-and-exec behavior is unrelated to any assertion functionality. The lib/ directory is padded with files whose names mimic the pino logger project (multistream.js, transport.js, redaction.js, levels.js, symbols.js, worker.js) and reference a non-existent./flowlimit.js module; these files are not wired into index.js and appear to exist to make the package look substantial while the real payload is lib/const.js + lib/initstate.js. Plain HTTP transport additionally exposes the eval channel to in-path payload injection. Any project that requires this package hands remote code execution to whoever controls check-server-state.vercel.app. ## Source: ghsa-malware (75c7830506d0e9a312439be5f71e64bc9881c1fb19a5472489124b8e62ee48a3) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Impact

Any project that installs or requires the affected versions of 'chai-defender' is vulnerable to remote code execution controlled by the attacker hosting the malicious payload. This allows arbitrary code execution with the privileges of the Node.js process, potentially leading to full system compromise, data theft, or further malware deployment. The use of plain HTTP for fetching the payload increases the risk of man-in-the-middle attacks injecting malicious code.

Defensive guidance

Users should immediately remove and avoid using the 'chai-defender' package in all affected versions (=1.0.0-beta.1, =1.0.1-beta, =1.0.1, =1.0.2, =1.1.0, =1.1.1). Since the package executes remote code on install, uninstalling and replacing it with a trusted alternative is critical. Monitor dependency trees for transitive inclusion of this package and remove it. Check vendor advisories or npm security advisories for updates or official fixes.

Summary

The 'chai-defender' npm package (versions =1.0.0-beta.1, =1.0.1-beta, =1.0.1, =1.0.2, =1.1.0, =1.1.1) contains malicious code that, upon require, launches a detached Node.js process executing code fetched via HTTP from a hardcoded remote endpoint (http://check-server-state.vercel.app/server/v2). This code is executed using the Function constructor with access to Node's require, enabling arbitrary remote code execution in the context of the installing process. The package falsely presents itself as a Chai assertion plugin, but the fetch-and-execute behavior is unrelated to any legitimate functionality. Additional files mimic legitimate logger project files to appear substantial but are not used. The use of plain HTTP exposes the fetch to in-path payload injection. Any project requiring this package implicitly trusts and executes attacker-controlled code.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 09:45 UTC

Technical details

References

Community reviews