registry / chai-foundry / 7.0.3

chai-foundry@7.0.3

This document describes the management of vulnerabilities for the project and all modules within the organization.

AI Security Review

scanned 9h ago · by lpm-firewall-ai

Importing the advertised main entrypoint immediately loads an opaque, heavily obfuscated payload. That payload accesses filesystem/platform APIs, runs child processes, and makes HTTP client requests.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Application runtime import/require of chai-foundry

Impact

Potential execution of downloaded/constructed commands and collection or transmission of local environment data.

Mechanism

import-time obfuscated command execution and network-capable payload

Attack narrative

A consumer requiring the package loads index.js, which unconditionally requires lib/config.js. The latter is a 4.1 MB obfuscated executable payload with filesystem, OS, child-process, environment-file, and axios networking capabilities. Its import-time placement conceals behavior unrelated to the advertised middleware/logger surface and permits command execution and outbound transmission in the consumer process.

Rationale

The source establishes a concrete import-time hidden payload with process execution and network capability; no legitimate package function accounts for it. Absence of lifecycle hooks limits installation-time scope but does not mitigate runtime compromise.

Evidence

package.jsonindex.jslib/config.js

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

chai-foundry@7.0.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code