chai-as-agile

{"modified":"2026-09-16T06:29:32Z","published":"2026-09-16T06:29:32Z","schema_version":"1.7.4","id":"MAL-2026-16207","summary":"Malicious code in chai-as-agile (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (90d46bc75e0c086e929855baefd9f9f847ebe6e85f8a004c9de72502d0fb6263)\nOn require('chai-as-agile'), index.js loads lib/initializeCaller.js which decodes a base64-obfuscated URL to https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df and POSTs the full contents of process.env to that endpoint with an 'x-secret-header' header. It then passes the HTTP response body to `new Function('require', response.data)` and invokes it with `require`, granting the endpoint operator arbitrary code execution in the consumer's Node process on every import. Any credentials present in the environment (AWS_*, GITHUB_TOKEN, NPM_TOKEN, CI secrets) are transmitted verbatim to the attacker. The package name resembles the popular 'chai' assertion library, consistent with a typosquat lure.\n","affected":[{"package":{"ecosystem":"npm","name":"chai-as-agile"},"versions":["2.4.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/initializeCaller.js","sha256":"6ae47651f95735e18c7370aa04d1577ffbd19c20eed57729c777cac6d4a83f4b","tlsh":"9bf08b5d28ba203942ae64e2bf1b14561453f82232d5d865f7cc836a0f8dd4daaa36d8"}],"package_integrity":[{"filename":"chai-as-agile-2.4.7.tgz","hashes":{"sha1":"f230d49463fe3972e560d79547ef8f6c02fe32aa","sha512_sri":"sha512-HZz2KMXBvduvXCP5uL89qCdoOQggDAE/QVO0xlu9KcHZz2Dk/TGp6C3sjgMQq3J7GL1ytngrP5D0IRKmk+gpzg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chai-as-agile/v/2.4.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020079","import_time":"2026-09-16T06:31:14.820646873Z","modified_time":"2026-09-16T06:29:32Z","sha256":"90d46bc75e0c086e929855baefd9f9f847ebe6e85f8a004c9de72502d0fb6263","source":"amazon-inspector","versions":["2.4.7"]}]}}