chai-as-agile

GHSA-5724-m8w6-w6g2

Malicious code in chai-as-agile (npm)

Details

**Severity:** Critical

**Affected versions:** `= 2.4.7`

## Source: amazon-inspector (90d46bc75e0c086e929855baefd9f9f847ebe6e85f8a004c9de72502d0fb6263)
On require('chai-as-agile'), index.js loads lib/initializeCaller.js which decodes a base64-obfuscated URL to https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df and POSTs the full contents of process.env to that endpoint with an 'x-secret-header' header. It then passes the HTTP response body to `new Function('require', response.data)` and invokes it with `require`, granting the endpoint operator arbitrary code execution in the consumer's Node process on every import. Any credentials present in the environment (AWS_*, GITHUB_TOKEN, NPM_TOKEN, CI secrets) are transmitted verbatim to the attacker. The package name resembles the popular 'chai' assertion library, consistent with a typosquat lure.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/a03f98a1b88f3ad29d120e41e5d5e14f25d25979/osv/malicious/npm/chai-as-agile/MAL-2026-16207.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/a03f98a1b88f3ad29d120e41e5d5e14f25d25979/osv/malicious/npm/chai-as-agile/MAL-2026-16207.json
- https://www.npmjs.com/package/chai-as-agile/v/2.4.7
- https://github.com/advisories/GHSA-5724-m8w6-w6g2

Compromised versions (1)

= 2.4.7

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.