chai-as-mno
This document describes the management of vulnerabilities for the project and all modules within the organization.
This report shows the evidence for chai-as-mno@1.0.5, the only known version.
This package appears in our research on the fake chai plugin campaign, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe unused import-time obfuscated payload is concrete malicious concealment and reaches runtime through the package main entrypoint. Absence of lifecycle hooks does not mitigate import-time execution.
Decision evidence
public snapshot- index.js imports lib/config.js at module load but never uses it.
- lib/config.js is a 4.08 MB single-line obfuscated program with runtime string-decoding logic.
- The hidden program contains axios, require, and process references.
- package.json has no preinstall, install, or postinstall hook.
- The visible entrypoint otherwise returns a no-op Express middleware.
Source & flagged code
6 flagged · loading sourceSource downloads or fetches remote code and executes it.
lib/config.jsView on unpkg · L1A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
lib/config.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to chai-as-mno@1.0.5.
The versions list below shows the verdict for each recorded version.
- Avoid installing chai-as-mno@1.0.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.