chai-smart (npm) · Malicious Code
Affects chai-smartSource GCVE Database
Malicious package : remove chai-smart and rotate any secrets on hosts that installed it.
Data as of 12 Sep 2026, 19:01 UTC
Malicious package
Published to npm · OSV MAL-2026-10054
What to do
Remove chai-smart from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmchai-smart | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'chai-smart' version 2.3.5 contains malicious code that masquerades as a pino-like logger API. It spawns a detached Node.js child process that decodes a hardcoded URL and sends the full environment variables of the consuming process to an attacker-controlled endpoint. The response from this endpoint is executed as arbitrary code within the consumer's Node.js process, enabling both credential exfiltration and remote code execution.