registry / chai-leaf / 1.4.8

chai-leaf@1.4.8

This document describes the management of vulnerabilities for the project and all modules within the organization.

AI Security Review

scanned 12h ago · by lpm-firewall-ai

Importing the package activates an obfuscated host-survey and network-exfiltration payload. The public entrypoint loads it unconditionally.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Runtime require/import of chai-leaf.

Impact

Leaks host-identifying data and exposes file/process operations to a concealed payload.

Mechanism

Obfuscated host collection with HTTP exfiltration and process/file-system capability.

Attack narrative

The main entrypoint imports lib/config.js during normal package loading. That obfuscated payload initializes immediately, loads OS/filesystem/process/network modules, collects hostname, platform, and username, and sends a structured axios request with a generated cryptographic validation value. It also contains filesystem enumeration and child-process execution paths, making the concealed runtime behavior a concrete malicious supply-chain payload.

Rationale

This is not an install-hook-only finding: the malicious payload is reached by an ordinary import. Its concealed host collection and outbound transmission are incompatible with the package's advertised middleware behavior.

Evidence

package.jsonindex.jslib/config.js

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

chai-leaf@1.4.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code