registry / Remote code execution / chai-as-byte
chai-as-byte
This document describes the management of vulnerabilities for the project and all modules within the organization.
This report shows the evidence for chai-as-byte@3.1.5. 2 of 2 known versions are blocked or flagged. The newest version, 3.1.6, is blocked. See all versions.
This package appears in our research on the fake chai plugin campaign, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains a concrete runtime exfiltration-and-remote-execution chain unrelated to its stated middleware/logger behavior. Absence of install hooks does not mitigate execution when consumers invoke the exported API.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
User application invokes the middleware exported by `index.js`.
Impact
Credential theft and arbitrary code execution in the consuming application's environment.
Mechanism
Detached env exfiltration followed by remote JavaScript execution.
Attack narrative
`index.js` starts `lib/initializeCaller.js` in a detached, unobserved Node process when its exported middleware is called. The helper decodes a concealed URL, sends a POST body containing all environment variables, then passes the response body to `new Function("require", ...)` and invokes it. The server therefore receives secrets and controls code executed in the host process context.
AI rationale
The package contains a concrete runtime exfiltration-and-remote-execution chain unrelated to its stated middleware/logger behavior. Absence of install hooks does not mitigate execution when consumers invoke the exported API.
Evidence
package.jsonindex.jslib/initializeCaller.js
Network endpoints1
ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `index.js` exports middleware that spawns a detached child.
- `lib/initializeCaller.js` POSTs the full `process.env`.
- The Base64 endpoint decodes to `https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df`.
- `lib/initializeCaller.js` executes server response with `new Function` and `require`.
- Child uses detached mode, ignored stdio, and `unref`, hiding runtime activity.
Evidence against
- `package.json` has no preinstall/install/postinstall lifecycle hook.
- No package-source filesystem write or AI-agent configuration mutation was found.
Behavioral surface
ChildProcessEnvironmentVarsEvalNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourceindex.jsView file
3const path = require('path');
L4: const { spawn } = require('child_process');
L5: const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');
High
3Cross-file remote execution chain: index.js spawns lib/initializeCaller.js; helper contains network access plus dynamic code execution.
L3: const path = require('path');
L4: const { spawn } = require('child_process');
L5: const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');
...
L37: function runBackgroundTask(args) {
L38: const scriptPath = path.resolve(__dirname, './lib/initializeCaller.js');
L39:
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
index.jsView on unpkg · L3•matchType = malicious_source_fingerprint_signature
signature = b37b7f32e1e38926
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = chai-as-sets@3.1.3
matchedPath = index.js
matchedIdentity = npm:Y2hhaS1hcy1zZXRz:3.1.3
similarity = 1.000
shingleOverlap = 12
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Findings
5 High3 Medium4 Low
HighChild Processindex.js
HighSame File Env Network Executionlib/initializeCaller.js
HighCross File Remote Execution Contextindex.js
HighBase64 Obscured Urllib/initializeCaller.js
HighKnown Malware Source Fingerprint Signatureindex.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndocs/transports.md
LowScripts Present
LowEvallib/initializeCaller.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to chai-as-byte@3.1.5.
The versions list below shows the verdict for each recorded version.
- Avoid installing chai-as-byte@3.1.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.