Threats Tagged 'mal-2026-10050'

The npm package 'chai-defender' contains malicious code that executes attacker-controlled JavaScript during its installation. When required, it spawns a detached Node.js process that fetches code from a remote HTTP endpoint and executes it with access to Node's require function, enabling remote code execution. The package masquerades as a security-focused Chai assertions plugin but performs no legitimate assertion functionality. The malicious behavior affects multiple specific versions of the package. This poses a severe risk to any project that includes this package as it grants full remote code execution to the attacker controlling the remote server.