chai-as-act@1.0.2
Malicious code in chai-as-act (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web ProtocolsT1105 · Ingress Tool TransferT1041 · Exfiltration Over C2 ChannelT1552.001 · Credentials In Files
Analysis
chai-as-act@1.0.2 is a combosquat of the legitimate chai-as-promised package. It ships a malicious file (lib/initializeCaller.js) that decodes a base64-embedded C2 URL (hxxps://ipcheck-hashed[.]vercel[.]app/api/auth/6c1d60d35852ef0c05df), POSTs all environment variables (process.env) to that endpoint, and executes the server's response as arbitrary JavaScript code via new Function("require", response.data) — enabling remote code execution on the installer's machine. The package is a trojanized copy of the pino logging library with the malicious payload added.
- analyzed by
- Leitwacht
- first seen
- Jul 14, 2026, 05:05 PM
- analyzed
- Jul 14, 2026, 05:09 PM
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.