LWA-2026-6994 confirmed malware
chai-as-deployer@2.3.6
Malicious code in chai-as-deployer (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
chai-as-deployer is a combosquat package that trojanizes the pino logging library with a javascript-obfuscator C2 implant in lib/config.js. When required, the package beacons to a remote C2 server at 167[.]88[.]167[.]54:8087 via HTTP POST to /api/log with host metadata (hostname, OS, username, platform), sends a notification to /api/notify, and exfiltrates system information as a file upload (sysinfo.txt) via multipart/form-data POST to 167[.]88[.]167[.]54:8085/upload.
- analyzed by
- Leitwacht
- first seen
- Jul 21, 2026, 08:55 PM
- analyzed
- Jul 21, 2026, 08:56 PM
- weekly installs
- 163
Related advisories
- chai-foundry@7.0.3
- quickbuf@1.0.1
- app-data-ist@2.1.6
- @offa-uwk/offa-uwk@999.0.6
- twilio-internal@99.99.99
- twilio-functions@99.99.99
- relativity-foundation-core@6.8.2
- relativity-pdfjs-dist@5.8.2
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.