MalwarePublished 10 Aug 2026Updated 23 Sep 2026

chai-tracker (npm) · Malicious Code

Affects chai-trackerSource GCVE Database

Malicious package : remove chai-tracker and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13704

What to do

Remove chai-tracker from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmchai-tracker	Affected 1.1.0 – 1.2.1 5 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The chai-tracker npm package contains malicious code that executes arbitrary code on the host system when the package is loaded. It mimics the legitimate chai-spies package but depends on an attacker-controlled package named dbconnectify pinned to 'latest'. Upon loading, chai-tracker spawns a detached child process that runs code from dbconnectify, allowing silent execution of arbitrary commands. This malicious behavior is disguised within chai method registration, making it difficult to detect during normal use.

Impact

Arbitrary code execution occurs on the host system at plugin load time, allowing attackers to run any code with the privileges of the user installing or running chai-tracker. The execution is silent and detached, making detection difficult. This can lead to compromise of the host environment, data theft, or further malicious activities.

Defensive guidance

Users should avoid installing or using the chai-tracker package. Audit dependencies carefully and verify package authenticity before use. Consider removing chai-tracker from projects and replacing it with legitimate alternatives such as chai-spies. Monitor for any unexpected child processes spawned by development tools.

Summary

chai-tracker is a malicious npm package impersonating chai-spies by matching its name, README, and keywords. It declares peerDependencies on an attacker-controlled package dbconnectify pinned to 'latest' and axios. When a consumer calls chai.use(require('chai-tracker')), the exported plugin function invokes a helper named assertConnection(), which does not perform assertions but instead spawns a detached child process executing inline code that requires dbconnectify and calls a method on it. Because dbconnectify is attacker-controlled and unversioned, arbitrary code executes on the installer's host silently with stdio ignored. The malicious code is concealed within the chai Assertion method registration process.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Aug 2026, 15:41 UTC

Technical details

References

Community reviews