Malware in chai-as-assured
Malware was discovered in the npm package chai-as-assured. Systems with this package installed are considered fully compromised and require immediate remediation.
- Disclosed
- Last updated
- Blast radius
- Any system with chai-as-assured installed or running
- Ecosystems
- Attack vectors
- Affected entities
- chai-as-assured
A malware incident was identified in the npm package chai-as-assured, published as GitHub Advisory GHSA-m282-3m8c-qjwj on June 30, 2026.\n\nAny computer with this package installed or running should be considered fully compromised. The advisory indicates that an outside entity may have gained full control of affected systems.\n\nImmediate remediation requires rotating all secrets and keys from a different, uncompromised computer. While the package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the compromise.\n\nUsers should assume complete system compromise and take appropriate incident response measures.
Indicators of compromise
- Packages
- chai-as-assured
Remediation
- Immediately rotate all secrets, keys, and credentials from a different, uncompromised computer
- Remove the chai-as-assured package from all affected systems
- Conduct a full security audit and forensic analysis of any system that had this package installed
- Monitor affected systems for signs of persistent malware or unauthorized access
- Consider rebuilding affected systems from clean media if full compromise is suspected
Sources
- GitHub Advisory GHSA-m282-3m8c-qjwj · GitHub Advisory Database
Cite this entry
"Malware in chai-as-assured." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed June 30, 2026; last updated June 30, 2026. https://supplychainattack.org/incident/malware-in-chai-as-assured-6hcwb1
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @ai-vertical/ai-agent
Malware was discovered in the npm package @ai-vertical/ai-agent. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmAI agents & skillsCompromised package - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - containedcritical
Malicious code in gunzip-js (npm)
The npm package gunzip-js version 99.9.1 was identified as malicious by the OpenSSF Package Analysis project. The malicious version communicates with a domain associated with malicious activity.
npmCompromised package