chai-utils-test@4.5.4
Malicious code in chai-utils-test (npm)
T1059 · Command and Scripting Interpreter
Analysis
chai-utils-test@4.5.4 is a combosquat of the chai assertion library acting as a multi-stage remote-code-execution dropper. Its index.js spawns a detached background node process (detached:true, child.unref()) running lib/chai/utils/assertion.js, which uses axios to fetch remote code from hxxps://statecheck[.]ddns[.]net/api/scanner.js with hardcoded base64 Basic-auth credentials (admin:secret123), then executes it via new Function("require", s) to grant the operator full require access. The publisher impersonates the real Chai maintainers.
- analyzed by
- Leitwacht
- first seen
- Jun 7, 2026, 09:12 PM
- analyzed
- Jun 7, 2026, 09:19 PM
Related advisories
- chai-utils-test@4.5.2 same package
- chai-utils-test@4.5.1 same package
- chai-utils-test@4.5.0 same package
- chai-utils-test@4.5.3 same package
- autotel-mongoose@2.0.5
- autotel-mongoose@3.0.1
- autotel-mongoose@6.0.1
- autotel-mongoose@4.0.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.