Malicious code in chai-as-regulated (npm)
The npm package chai-as-regulated is a typosquat of the popular chai-as-promised plugin that contains malicious code infrastructure designed to spawn detached background processes. While the current version lacks an active payload, the package is structured as a loader for future malicious code injection.
- Disclosed
- Last updated
- Blast radius
- Any npm user installing chai-as-regulated and calling chai.use(chaiAsRegulated) in their application
- Ecosystems
- Attack vectors
- Affected entities
- chai-as-regulatedTyposquat package mimicking chai-as-promised
The npm package chai-as-regulated is a typosquat targeting the widely-used chai-as-promised Chai plugin. The package README instructs users to register it via chai.use(chaiAsRegulated), mimicking legitimate usage patterns.
However, the package does not implement a functional Chai plugin. Instead, the tarball contains unrelated Pino logger source files (lib/levels.js, lib/proto.js, lib/tools.js, lib/transport.js) and boilerplate package.json metadata, serving as cover for the malicious intent.
The exported middleware in index.js (lines 32-50) contains a silent background-process launcher that calls child_process.spawn('node', [scriptPath, JSON.stringify(args)], { detached: true, stdio: 'ignore' }) followed by child.unref(). This spawns a detached orphan process pointing to ./lib/initializeCaller.js, passing caller-supplied arguments. The referenced initializeCaller.js file is absent from the current tarball, indicating the infrastructure is staged for future payload injection.
The combination of name confusion, copied unrelated source as cover, and a silent background-launcher wired into the advertised API demonstrates a structured attack framework designed for future malicious code execution.
Indicators of compromise
- Packages
- chai-as-regulated
Remediation
- Remove chai-as-regulated from all projects immediately
- Audit npm dependencies for similar typosquats of popular packages
- Use npm audit and supply chain security tools to detect suspicious packages
- Replace with the legitimate chai-as-promised package if Chai assertion chaining is needed
- Review any systems where chai-as-regulated was installed for signs of unauthorized process execution
Sources
- GitHub Advisory GHSA-97qj-8m4x-2m8j · GitHub Advisory Database
Cite this entry
"Malicious code in chai-as-regulated (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-chai-as-regulated-npm-ps3m9e
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in cheerio-tool (npm)
cheerio-tool, a typosquatting package on npm impersonating the popular cheerio HTML parser, contained malicious postinstall code that harvested npm credentials, API keys, cloud credentials, and cryptocurrency wallet data from infected systems.
npmTyposquattingCompromised package - containedcritical
Malicious code in prisma-callback (npm)
prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
npmCompromised packageTyposquatting - containedcritical
Malicious code in hardhat-core (npm)
The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.
npmTyposquattingCompromised package