registry / chai-as-stringify / 7.0.2

chai-as-stringify@7.0.2

This document describes the management of vulnerabilities for the project and all modules within the organization.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Importing the package executes an obfuscated payload. It creates hidden detached processes and sends host/user and supplied data to an obfuscated remote endpoint.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Runtime import/require of chai-as-stringify.

Impact

Unconsented host metadata and application-supplied data disclosure; background process execution.

Mechanism

Import-time persistence-like process spawning and network exfiltration.

Attack narrative

index.js loads lib/config.js immediately. That file runs top-level obfuscated code, imports OS/filesystem/process/network modules, launches detached hidden child processes, and uses axios to transmit a record containing host, OS, username, message, and data to an obfuscated endpoint. This behavior is unrelated to the advertised Chai stringify package.

Rationale

Source inspection confirms concrete import-time data exfiltration and stealthy background execution. The absence of an install hook does not remove the runtime compromise path.

Evidence

package.jsonindex.jslib/config.js

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json exposes index.js with no lifecycle hook.

chai-as-stringify@7.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code