LWA-2026-6870 confirmed malware
chai-tracker@1.1.0
Malicious code in chai-tracker (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1105 · Ingress Tool Transfer
Analysis
chai-tracker is a combosquat of the chai assertion library ecosystem. When the module is loaded (require('chai-tracker')), it spawns a hidden child Node.js process that loads a peer dependency named "dbconnectify" and calls its queryDBConnect() method. This acts as a second-stage loader — the dbconnectify package (also published by the same actor) contains the actual malicious behaviour. The spawn is detached (stdio: "ignore"), running silently in the background without the installer's knowledge.
- analyzed by
- Leitwacht
- first seen
- Jul 16, 2026, 11:01 PM
- analyzed
- Jul 16, 2026, 11:02 PM
Related advisories
- web3-terminal@2.1.6
- my-tailwind-gutenberg-block@0.1.2
- chai-assertions-plus@6.0.4
- mcp-dev-toolkit@1.5.0
- time-format-kit@1.0.2
- application-util@2.1.6
- http-req-lite@1.0.0
- sync-grove@1.0.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.