Malicious code in chai-leaf (npm)

The npm package chai-leaf (versions 1.4.5 through 1.4.8) includes a large obfuscated JavaScript file (lib/config.js) that runs at load time. This file contains code to steal credentials from the installer's home directory, specifically targeting SSH and AWS credential directories, and exfiltrates these secrets over HTTP using the axios library. The package's metadata and README are deceptive, copying content from unrelated legitimate packages to disguise its malicious intent. The presence of this package on a system indicates a full compromise, as it grants remote attackers access to sensitive credentials.

Systems with the affected versions of chai-leaf installed are fully compromised. Attackers can steal SSH and AWS credentials stored on the system, potentially leading to unauthorized access to other systems and cloud resources. The compromise may extend beyond the package itself, as attackers could deploy additional malicious software. Removing the package alone does not guarantee remediation due to possible persistent backdoors.

Immediate removal of the chai-leaf package versions 1.4.5, 1.4.6, 1.4.7, and 1.4.8 is required. All credentials and secrets stored on the compromised system, including SSH keys and AWS credentials, must be rotated from a separate, secure system. Due to the high likelihood of full system compromise, a comprehensive incident response and forensic analysis should be conducted to identify and remove any additional malicious artifacts. No official patch or fix is available; remediation relies on removal and credential rotation.