Malicious code in chai-plus (npm)

The 'chai-plus' npm package includes a top-level immediately invoked function expression (IIFE) in lib/index.js that automatically runs Bootstrap.execute(). This function spawns a command to install '[email protected]' globally via npm and then executes it with hardcoded arguments pointing to a command-and-control server at 'http://coolblast.zapto.org:8888/api/x-handler'. The operation is silently executed without user consent or visible errors, contradicting comments claiming it is user-invoked. The package name closely resembles the legitimate 'chai' assertion library, increasing the likelihood of accidental installation. This behavior effectively compromises any system using the package, allowing attackers to gain full control.

Any system that installs or runs 'chai-plus' is considered fully compromised. Attackers may gain complete control over the affected machine, potentially accessing all stored secrets and keys. Because the malicious code executes automatically on module load and installs additional malicious software, the integrity and confidentiality of the system are severely impacted. Simply removing the package may not eliminate all malicious components or backdoors introduced by the attacker.

Remove the 'chai-plus' package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on compromised machines from a secure, unaffected environment. Due to the high likelihood of full system compromise, consider rebuilding affected systems from trusted sources. Monitor for any signs of persistent malicious activity. No official patch or fix is available; the package itself is malicious and should not be used.