registry / chai-as-deployer / 2.3.6

chai-as-deployer@2.3.6

This document describes the management of vulnerabilities for the project and all modules within the organization.

AI Security Review

scanned 9h ago · by lpm-firewall-ai

Importing the package loads an unrelated 4 MB obfuscated payload. The public entrypoint exposes a no-op middleware, making the config import a hidden import-time side effect.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any application require/import of chai-as-deployer.

Impact

Hidden runtime execution can inspect the host and launch additional commands or payload behavior.

Mechanism

Import-time obfuscated payload with decoded process and filesystem operations.

Attack narrative

Requiring index.js immediately evaluates lib/config.js. That file is a 4 MB obfuscated, self-decoding payload unrelated to the advertised middleware; its source includes anti-analysis logic, directory enumeration, and construction of process-execution options. Since index.js does not use the imported config and otherwise returns a no-op middleware, the import exists to trigger concealed behavior.

Rationale

The hidden import-time payload and concealed host/process capability are concrete malicious behavior, not package-aligned functionality. Absence of an install hook does not mitigate execution on normal import.

Evidence

package.jsonindex.jslib/config.js

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

chai-as-deployer@2.3.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code