Threats Tagged 'mal-2026-6995'

The npm package chai-redirection (versions 0.0.1, 0.0.3, and 0.0.4) contains malicious code that executes attacker-controlled JavaScript immediately upon being required. It spawns a detached Node.js process that fetches code from a mutable external source and executes it with full require access, enabling remote code execution. This malicious behavior occurs before any legitimate plugin functionality is used, making mere installation or inclusion a critical risk. The mutable external payload can be changed at any time without republishing the package, increasing the threat's persistence and unpredictability. Systems with this package installed should be considered fully compromised, and all secrets should be rotated. Removal of the package alone may not eliminate all malicious artifacts.