MalwarePublished 15 Apr 2026Updated 1 Sep 2026

lockedin-chai-chain (npm) · Malicious Code

Affects lockedin-chai-chainSource GCVE Database

What to do

Affected software

Product	Affected	Fixed in
npmlockedin-chai-chain	Affected =1.2.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package lockedin-chai-chain version 1.2.6 contains malicious code that downloads and executes a command-and-control (C2) dropper from a remote URL. This behavior is similar to previously observed malware in related packages. No official patch or remediation guidance is provided in the available data.

Impact

The malicious code enables execution of a remote payload, which can lead to unauthorized control of the affected environment where the package is used. This poses a significant security risk including potential data compromise or system manipulation. Since the package executes a C2 dropper, it may facilitate persistent access or further malware deployment.

Defensive guidance

Users should immediately remove or avoid using the lockedin-chai-chain package version 1.2.6. Verify dependencies and replace this package with a trusted alternative. Monitor for any unusual activity related to this package and consider scanning environments where it was used for signs of compromise.

Summary

The lockedin-chai-chain npm package at version 1.2.6 is identified as malicious. When imported, it downloads a C2 dropper payload from https://jsonkeeper[.]com/b/FAWPU and executes it, enabling potential remote control or further malicious activity. This package is part of the npm ecosystem and has been flagged by Amazon Inspector and the GCVE database. There is no information on a patch or fix, and no known exploits in the wild have been reported.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Sep 2026, 11:08 UTC

Technical details

References

Community reviews