Malicious code in chaikit (npm)

The 'chaikit' npm package (version 2.3.5) includes a main entry file that unconditionally loads a heavily obfuscated ~4MB JavaScript file using an RC4 string-array decoder with approximately 23,902 entries. This obfuscated code executes immediately upon import, performing opaque operations. The package bundles axios as a runtime dependency, providing the obfuscated code with network egress capabilities. The package's metadata and README attempt to impersonate popular developer tools (pino logger and chai testing framework) to deceive users searching for those tools. The actual middleware exported is a trivial passthrough, indicating the obfuscated code is the primary behavior. This pattern is consistent with a supply-chain malware loader designed to execute harmful payloads in the consumer's environment.

Any project or environment that imports 'chaikit' version 2.3.5 will execute the embedded obfuscated malicious code, potentially allowing unauthorized network communication and further compromise. The malicious payload could lead to data exfiltration, system compromise, or further malware installation. The deceptive metadata increases the risk of inadvertent installation by developers seeking legitimate packages.

No official patch or remediation is currently documented. Users should immediately remove and avoid using 'chaikit' version 2.3.5. Verify dependencies and audit package sources carefully to avoid supply-chain malware. Monitor for updates or advisories from the package maintainers or npm registry regarding this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.