MalwarePublished 9 Jul 2026

chai-secure (npm) · Malicious Code

Affects chai-secureSource GCVE Database

Malicious package : remove chai-secure and rotate any secrets on hosts that installed it.

Data as of 10 Jul 2026, 10:11 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10053

What to do

Remove chai-secure from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmchai-secure	Affected =1.2.3 =1.2.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package chai-secure versions 1.2.3 and 1.2.5 contains malicious code that executes attacker-controlled JavaScript on the host machine. Upon import, it silently spawns a detached Node.js child process that fetches code from a remote HTTP server and executes it with full privileges. This behavior is hidden from the README and uses evasion techniques such as delivering payload via a 404 response. The package masquerades as a Chai plugin providing assertion helpers but instead performs unauthorized remote code execution.

Impact

Any developer or system that installs and imports chai-secure versions 1.2.3 or 1.2.5 will unknowingly execute arbitrary attacker-controlled JavaScript code with full privileges on their machine. This can lead to complete compromise of the host environment, data theft, persistence, or further malicious activity. The malicious code runs silently in a detached background process, making detection difficult without specialized inspection.

Defensive guidance

Users should immediately avoid installing or importing this package. Remove any existing installations of chai-secure versions 1.2.3 and 1.2.5 from projects and systems. Monitor for any unexpected child processes or network connections to suspicious domains. Check the vendor advisory or trusted security sources for updates regarding remediation or safe alternatives.

Summary

chai-secure (npm) versions 1.2.3 and 1.2.5 include malicious functionality where requiring or importing the package triggers a detached Node.js child process that makes an HTTP GET request to a remote server. If the server responds with a 404 status containing a 'token' field, the package dynamically constructs and executes JavaScript code from this token with full privileges on the host. The package uses this covert channel to execute arbitrary attacker-supplied code, bypassing casual inspection by hiding the payload delivery in a 404 response and using plain HTTP. Additional files in the package are included to inflate its apparent legitimacy. This results in silent remote code execution on any system that installs and imports the package as documented.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 10:11 UTC

Technical details

References

Community reviews