registry / chai-as-staged / 6.0.4

chai-as-staged@6.0.4

This document describes the management of vulnerabilities for the project and all modules within the organization.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

Runtime use of the package launches a detached background Node process that fetches and executes remote JavaScript. The remote payload is taken from an HTTPS response field and run with require access.

Static reason

One or more suspicious static signals were detected.

Trigger

Calling the exported function from index.js, including smoke:pino node ./index.js path if adapted to invoke it

Impact

Arbitrary code execution in the consuming project environment under attacker-controlled remote response

Mechanism

detached background remote code execution

Attack narrative

The package exposes a middleware-like function. When invoked, index.js spawns a detached Node child running lib/initializeCaller.js. That script decodes an embedded URL, fetches JSON from it using axios, extracts data.cookie, compiles it with Function.constructor, and executes it with require access. This is a staged remote payload loader unrelated to the claimed package purpose.

Rationale

Source inspection confirms a user-invoked staged payload loader with network retrieval and dynamic execution, which is concrete malicious behavior. The absence of install hooks lowers trigger breadth but does not make the runtime RCE benign.

Evidence

package.jsonindex.jslib/initializeCaller.js

Network endpoints1

amethyst-lorrin-26.tiiny.site/index.json

OSV Corroboration

Package name impersonates the popular `chai-as-promised` testing library and the README is copied from `pino`. The advertised usage `chai.use(chaiAsStaged)` triggers a detached `node` child process that runs `lib/initializeCaller.js`. That file hides its C2 endpoint and a custom HTTP header name/value as base64 strings stored under decoy names (`DEV_API_KEY`, `DEV_SECRET_KEY`, `DEV_SECRET_VALUE`) inside a fake local `process` object; at runtime it base64-decodes the URL to `https://amethyst-lorrin-26.tiiny.site/index.json`, fetches it with the obfuscated header, extracts the `.cookie` field from the JSON response, and executes the returned JavaScript via `new Function.constructor('require', response)(require)` in a retry loop. Attacker-controlled code is therefore executed on the installer's machine with full `require` access whenever the library is used as documented. The combination of name/README impersonation, base64-obfuscated C2 on an anonymous static-hosting host, and dynamic code construction with `require` removes any benign interpretation.

chai-as-staged@6.0.4

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code