chai-tracker

{"modified":"2026-08-10T12:53:38Z","published":"2026-08-10T12:29:01Z","schema_version":"1.7.4","id":"MAL-2026-13704","summary":"Malicious code in chai-tracker (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d61869c26ad8015b88350d312fa37f5e18d536794ce5d8c46bf4239b2154b1a9)\nchai-tracker mimics chai-spies (matching name, README, and keywords) but declares peerDependencies on dbconnectify pinned to 'latest' and axios. The exported chai plugin function, invoked when a consumer calls chai.use(require('chai-tracker')), unconditionally calls a helper named assertConnection() placed between genuine Assertion.overwriteMethod definitions. Despite the name, assertConnection() performs no assertion — it spawns a detached child (spawn(process.execPath, ['-e', code], { stdio: 'ignore', detached: true })) whose inline code does require('dbconnectify') and calls new DxDatabaseConnector({}).queryDBConnect(). Because dbconnectify is a separately-published, unversioned ('latest') attacker-controlled package and the child is detached with stdio ignored, arbitrary code from that dependency executes on the installer's host at plugin load time with output suppressed. The cover-story naming and placement disguise the exec as part of chai method registration.\n","affected":[{"package":{"ecosystem":"npm","name":"chai-tracker"},"versions":["1.2.1","1.1.0","1.1.1","1.1.2","1.1.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/spy.js","sha256":"e31d0b8dc56858829800f14ed45b3e08be9b98bf98b1c4352e38a08342e667a3","tlsh":"9e92334922d371a0c6a3b37c0e2f64a8e023861f1099dd593dece2dc6f98e754695cf9"},{"path":"package.json","sha256":"cbbbfd737b6d94ddf658e65678de3192b2fbb8140d3bd0ea0f65d87adc16034b","tlsh":"51115964cb788d2315d861a8947a0197713589079e59fc1d73b3810c9f0d92f20fad6c"}],"package_integrity":[{"filename":"chai-tracker-1.2.1.tgz","hashes":{"sha1":"7f03147d555745361eafab8a7b4c370a0b020488","sha512_sri":"sha512-a2Vn/k7TSh6+L/CgKaLzeDwney7vQAukw+UPU85gzFz4dXUNbpxE2T7B/7eCjEOUjc61chBuD6+njWpn/sClow=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-tracker/v/1.2.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-tracker/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-tracker/v/1.1.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-tracker/v/1.1.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-tracker/v/1.1.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017261","import_time":"2026-08-10T12:51:44.813391486Z","modified_time":"2026-08-10T12:29:01Z","sha256":"12a7bbd6d78534877f788d24df2bcc7b62ec10c5b56b2bd218d7cb25edb4b8ca","source":"amazon-inspector","versions":["1.2.1"]},{"id":"IN-MAL-2026-017263","import_time":"2026-08-10T12:51:44.894166099Z","modified_time":"2026-08-10T12:29:18Z","sha256":"3ab2d9f276d6fb4a594c7e8b395c390ce7d73828e4756214a008a7e981a64539","source":"amazon-inspector","versions":["1.1.0"]},{"id":"IN-MAL-2026-017265","import_time":"2026-08-10T12:51:44.996275021Z","modified_time":"2026-08-10T12:29:36Z","sha256":"86283c9d77d09bb74e1740b9e82054c894450ed060e09afc5aae14cc973e8660","source":"amazon-inspector","versions":["1.1.1"]},{"id":"IN-MAL-2026-017264","import_time":"2026-08-10T12:51:44.930572418Z","modified_time":"2026-08-10T12:29:27Z","sha256":"94d712ff478a98bdc7c5b7b2fb76a0c79fb85378ffc15741aa1e77688e515718","source":"amazon-inspector","versions":["1.1.2"]},{"id":"IN-MAL-2026-017262","import_time":"2026-08-10T12:51:44.849446509Z","modified_time":"2026-08-10T12:29:09Z","sha256":"d61869c26ad8015b88350d312fa37f5e18d536794ce5d8c46bf4239b2154b1a9","source":"amazon-inspector","versions":["1.1.3"]}]}}