registry / Remote code execution / chai-as-sets
chai-as-sets
This document describes the management of vulnerabilities for the project and all modules within the organization.
This report shows the evidence for chai-as-sets@3.1.3, the only known version.
This package appears in our research on the fake chai plugin campaign, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiConfirmed source behavior is a covert runtime payload chain: full environment exfiltration to a concealed endpoint followed by remotely supplied code execution. The absence of install hooks does not mitigate this concrete malicious behavior.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Application calls the exported middleware from `index.js`.
Impact
Secrets in the host environment can be sent to the operator, and the response can execute arbitrary Node code with the application's permissions.
Mechanism
Detached environment exfiltration followed by remote arbitrary code execution.
Attack narrative
At runtime, the exported middleware invokes `runBackgroundTask`, which spawns `lib/initializeCaller.js` detached with ignored stdio. The helper decodes a hidden URL, posts all environment variables to it, then compiles and invokes the response body via `new Function`, passing CommonJS `require`. This gives the remote endpoint code execution in the consuming process context after secret exfiltration.
AI rationale
Confirmed source behavior is a covert runtime payload chain: full environment exfiltration to a concealed endpoint followed by remotely supplied code execution. The absence of install hooks does not mitigate this concrete malicious behavior.
Evidence
package.jsonindex.jslib/initializeCaller.jsREADME.md
Network endpoints1
ipcheck-hashed.vercel.app/api/auth/00fbe23fd7efc30639f1
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `index.js` is the package main and spawns `lib/initializeCaller.js` detached.
- Middleware invocation triggers the hidden background child process.
- `lib/initializeCaller.js` POSTs the full `process.env` object to a Base64-hidden endpoint.
- The response body is executed with `new Function("require", response.data)`.
- The remote executor receives `require`, enabling arbitrary local module access.
- README/package metadata describe unrelated Chai/Pino behavior, inconsistent with the payload.
Evidence against
- `package.json` has no npm install lifecycle hooks.
- No native binaries or executable artifacts were found.
- No AI-agent control-surface mutation is present.
Behavioral surface
ChildProcessEnvironmentVarsEvalNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourceindex.jsView file
3const path = require('path');
L4: const { spawn } = require('child_process');
L5: const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');
High
3Cross-file remote execution chain: index.js spawns lib/initializeCaller.js; helper contains network access plus dynamic code execution.
L3: const path = require('path');
L4: const { spawn } = require('child_process');
L5: const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');
...
L37: function runBackgroundTask(args) {
L38: const scriptPath = path.resolve(__dirname, './lib/initializeCaller.js');
L39:
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
index.jsView on unpkg · L3•matchType = malicious_source_fingerprint_signature
signature = b37b7f32e1e38926
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = chai-as-const@1.4.5
matchedPath = index.js
matchedIdentity = npm:Y2hhaS1hcy1jb25zdA:1.4.5
similarity = 1.000
shingleOverlap = 12
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Findings
5 High3 Medium4 Low
HighChild Processindex.js
HighSame File Env Network Executionlib/initializeCaller.js
HighCross File Remote Execution Contextindex.js
HighBase64 Obscured Urllib/initializeCaller.js
HighKnown Malware Source Fingerprint Signatureindex.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndocs/transports.md
LowScripts Present
LowEvallib/initializeCaller.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to chai-as-sets@3.1.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing chai-as-sets@3.1.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.