chai npm Typosquats Flagged as Critical Malware Wave

A batch of malicious npm packages that impersonate chai, one of the most widely used JavaScript assertion libraries, was flagged as critical malware on 2026-08-10. The cluster includes chai-tracker, chai-as-format, chai-as-deployer, and chai-as-promised-plus. Each name borrows the chai brand to pass as a helper or plugin for a library that ships inside a large share of JavaScript test suites. The flags landed next to a broader wave of npm and PyPI packages caught in the same 48 hour window, including apparent typosquats of neverthrow, postcss, and SQLite tooling on npm, plus a run of crypto and DeFi themed packages on PyPI. Here is what is confirmed, who is exposed, and the exact commands to check your own projects.

A note on scope before we start. This writeup is based on our incident catalog records and on the identities of the legitimate packages being copied. Where a detail was not public at the time of writing, we say so rather than guess.

What happened with the chai npm packages

Our incident catalog recorded four npm packages built around the chai name as carrying malicious code, each rated critical, with entries updated on 2026-08-10. The legitimate chai project is not the source of these uploads. The malicious packages are separate projects published under chai-adjacent names, which is a textbook typosquatting and brandjacking move.

One of them, chai-as-promised-plus, mimics the real chai-as-promised plugin that many test suites use for async assertions. The others, chai-tracker, chai-as-format, and chai-as-deployer, lean on the same brand to look like plausible add-ons for a package a developer already trusts.

By the time the entries were published, the registry listings for the flagged packages had been pulled, and per package payload details were limited to the malicious-code classification. We have not independently confirmed the exact payload, version numbers, or download totals for each package in this cluster.

The wider npm and PyPI wave

The chai packages did not arrive alone. In the same window, our catalog logged a set of other npm packages as malicious, several of them clear brand plays. neverthrow-js sits right next to the real neverthrow error-handling library. postcss-initial-provider trades on the postcss ecosystem. Two packages under a scoped org, @sqlite-labs/createsql and @sqlite-labs/nodesql, pose as SQLite tooling. Others in the same batch include iconova-react, @ssgw/icon, @noobaihome/amis-simple-area-widget, polymarket-stake-mathss, xerohub-discord-voice, spoint, svelte-kit-streak, and kit-map-streak.

On PyPI, the same 48 hours brought a run of crypto and DeFi themed packages. bigtime and dlmm were updated on 2026-08-11. btcflip and btcflx carry obvious Bitcoin branding, and neutrl-core, neutrl-contracts, plp-contract, and kotoraka round out the group. Whether all of these share a single operator is not established. What we can say is that they were flagged inside the same short window and follow the same low-effort naming strategy we have tracked in earlier waves.

Timeline

• 2026-08-10: Four chai-branded npm packages (chai-tracker, chai-as-format, chai-as-deployer, chai-as-promised-plus) are recorded as malicious and rated critical, along with a larger batch of npm packages that includes neverthrow-js, postcss-initial-provider, and the @sqlite-labs pair.
• 2026-08-11: PyPI entries for bigtime and dlmm are updated, extending the crypto and DeFi themed run that also covers btcflip, btcflx, neutrl-core, neutrl-contracts, plp-contract, and kotoraka.
• Ongoing: Registry listings for the flagged packages have been removed. Detailed public payload writeups were not available at the time of writing.

Who is affected

Two groups carry most of the risk. The first is any developer or CI job that installed one of the named packages, whether by a typo, a copy-paste from a bad tutorial, or an automated dependency suggestion. The second is any build pipeline that resolves dependencies fresh on every run, because those environments often hold cloud tokens, npm publish tokens, and signing material.

Test and build libraries are a deliberate target. chai and its plugins run in exactly the places attackers want to reach: developer laptops and CI runners that hold secrets. A package that looks like a chai plugin has a realistic path into a devDependencies block, where it can execute during a test or install step. That is where credential theft usually happens.

If you only ever install the real chai and chai-as-promised, and your lockfile pins them to their genuine registry entries, you are almost certainly fine. The danger sits in the near-miss names.

How this class of attack works

We have not reverse engineered each payload in this cluster, so treat the following as the typical pattern for npm and PyPI malware of this kind rather than a confirmed description of every package here.

These campaigns usually rely on two things. The first is name confusion. Attackers publish a package whose name is one character off, or that appends a common word like "plus", "js", "tracker", or "provider" to a trusted name. The second is execution during install. On npm that has historically meant a postinstall or preinstall script in package.json. On PyPI it means code in setup.py or a build hook that runs when pip builds the package. Once that code runs, it commonly reads environment variables, npm and cloud credential files, SSH keys, and wallet material, then ships them to an attacker-controlled endpoint.

Crypto themed names such as btcflip, dlmm, and the neutrl set suggest the PyPI side of this wave is aimed at wallet keys and exchange or DeFi API secrets. That fits a long-running trend of registry malware that targets crypto developers specifically. Again, that is intent inferred from the names and the flags, not from a confirmed sample.

How to check if you installed a fake chai package

Start with a direct search of your dependency tree and lockfiles. For npm, pnpm, and yarn projects, run these from the repo root.

npm ls chai-tracker chai-as-format chai-as-deployer chai-as-promised-plus neverthrow-js postcss-initial-provider 2>/dev/null

grep -RniE "chai-tracker|chai-as-format|chai-as-deployer|chai-as-promised-plus|neverthrow-js|postcss-initial-provider|@sqlite-labs/(createsql|nodesql)" package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null

For Python environments, check installed distributions and any requirements files.

pip list 2>/dev/null | grep -Ei "^(bigtime|dlmm|btcflip|btcflx|kotoraka|neutrl-core|neutrl-contracts|plp-contract) "

grep -RniE "bigtime|dlmm|btcflip|btcflx|kotoraka|neutrl-core|neutrl-contracts|plp-contract" requirements*.txt pyproject.toml poetry.lock Pipfile.lock 2>/dev/null

If none of these return a match, the flagged packages are not in your tree. If any do match, treat the host as potentially compromised and move straight to remediation.

Remediation

Remove the package first, then clean the tree so a cached copy does not reappear. For npm:

npm uninstall <package-name>
rm -rf node_modules package-lock.json
npm install --ignore-scripts

For Python:

pip uninstall -y <package-name>

Do not stop at uninstalling. If a malicious package executed on a developer machine or a CI runner, assume any secret reachable from that environment is exposed. Rotate npm tokens, cloud provider keys, CI secrets, and SSH keys, plus any crypto wallet keys or exchange API keys that lived on the host. Invalidate active sessions where you can.

Two settings reduce the blast radius going forward. Install with scripts disabled by default (npm supports --ignore-scripts, and npm v12 blocks install scripts by default), and pin dependencies with a committed lockfile so a mistyped name cannot silently resolve to a fresh malicious upload. In CI, run installs with least-privilege tokens and short-lived credentials so a single poisoned build cannot walk away with long-lived keys.

FAQ

Is chai safe to use?

Yes. The genuine chai assertion library and the genuine chai-as-promised plugin are not the packages flagged here. The malicious uploads are separate projects with chai-like names, such as chai-as-promised-plus and chai-tracker. Confirm your lockfile points at the real chai and chai-as-promised, and be wary of any package that adds a suffix like "plus" or "tracker" to a name you already trust.

How do I know if I am affected by the chai npm malware?

Search your dependency tree and lockfiles for the exact names using the npm ls and grep commands above. A clean result means the flagged packages are not installed. A match means you should assume the host handled attacker code and rotate the secrets that were reachable from it.

What should I do if I already installed one of these packages?

Remove it, delete node_modules and your lockfile, reinstall with scripts disabled, and then rotate every credential that lived on the affected machine or runner. For the PyPI crypto themed packages, prioritize wallet keys and exchange or DeFi API keys, because those are the most likely targets.

Why do attackers keep typosquatting testing libraries?

Because test and build dependencies run where the secrets are. A fake chai plugin has a realistic route into a devDependencies block and onto CI runners that hold tokens and keys. Small, low-effort name variants are cheap to publish, and they only need to catch a handful of installs to pay off.