Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in chai-as-regulated (npm)

The npm package chai-as-regulated is a typosquat of the popular chai-as-promised plugin that contains malicious code infrastructure designed to spawn detached background processes. While the current version lacks an active payload, the package is structured as a loader for future malicious code injection.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any npm user installing chai-as-regulated and calling chai.use(chaiAsRegulated) in their application
Ecosystems
Attack vectors
Affected entities
  • chai-as-regulatedTyposquat package mimicking chai-as-promised

The npm package chai-as-regulated is a typosquat targeting the widely-used chai-as-promised Chai plugin. The package README instructs users to register it via chai.use(chaiAsRegulated), mimicking legitimate usage patterns.

However, the package does not implement a functional Chai plugin. Instead, the tarball contains unrelated Pino logger source files (lib/levels.js, lib/proto.js, lib/tools.js, lib/transport.js) and boilerplate package.json metadata, serving as cover for the malicious intent.

The exported middleware in index.js (lines 32-50) contains a silent background-process launcher that calls child_process.spawn('node', [scriptPath, JSON.stringify(args)], { detached: true, stdio: 'ignore' }) followed by child.unref(). This spawns a detached orphan process pointing to ./lib/initializeCaller.js, passing caller-supplied arguments. The referenced initializeCaller.js file is absent from the current tarball, indicating the infrastructure is staged for future payload injection.

The combination of name confusion, copied unrelated source as cover, and a silent background-launcher wired into the advertised API demonstrates a structured attack framework designed for future malicious code execution.

Indicators of compromise

Packages
  • chai-as-regulated

Remediation

  • Remove chai-as-regulated from all projects immediately
  • Audit npm dependencies for similar typosquats of popular packages
  • Use npm audit and supply chain security tools to detect suspicious packages
  • Replace with the legitimate chai-as-promised package if Chai assertion chaining is needed
  • Review any systems where chai-as-regulated was installed for signs of unauthorized process execution

Sources

  1. GitHub Advisory GHSA-97qj-8m4x-2m8j · GitHub Advisory Database

Cite this entry

"Malicious code in chai-as-regulated (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-chai-as-regulated-npm-ps3m9e

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

  1. containedcritical

    Malicious code in cheerio-tool (npm)

    cheerio-tool, a typosquatting package on npm impersonating the popular cheerio HTML parser, contained malicious postinstall code that harvested npm credentials, API keys, cloud credentials, and cryptocurrency wallet data from infected systems.

    npmTyposquattingCompromised package
  2. containedcritical

    Malicious code in prisma-callback (npm)

    prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.

    npmTyposquattingCompromised package
  3. resolvedcritical

    Malicious code in prettier-lint-lenz (npm)

    The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.

    npmCompromised packageTyposquatting
  4. containedcritical

    Malicious code in hardhat-core (npm)

    The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.

    npmTyposquattingCompromised package