Malicious code in chai-fetchs (npm)

The package 'chai-fetchs' at version 3.1.9 in the npm ecosystem is flagged for containing malicious code, as recorded under the identifier MAL-2026-7244 and alias GHSA-h2vx-499h-gp6h. This represents a malicious package threat rather than a traditional software vulnerability. There is no detailed technical description or CVSS score available, and no known exploits have been observed. No patch or fix information is provided, indicating that remediation status is unknown.

Use of the compromised 'chai-fetchs' package version 3.1.9 may lead to execution of malicious code within dependent projects, potentially compromising system integrity or confidentiality. The exact impact is not detailed, but supply chain compromises can lead to unauthorized access, data leakage, or further malware deployment.

Patch status is not yet confirmed—check the vendor advisory or npm security advisories for current remediation guidance. Until a fix or official guidance is available, avoid using version 3.1.9 of 'chai-fetchs' and consider removing or replacing this package in your projects.