chai-as-agile

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (90d46bc75e0c086e929855baefd9f9f847ebe6e85f8a004c9de72502d0fb6263)
On require('chai-as-agile'), index.js loads lib/initializeCaller.js which decodes a base64-obfuscated URL to https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df and POSTs the full contents of process.env to that endpoint with an 'x-secret-header' header. It then passes the HTTP response body to `new Function('require', response.data)` and invokes it with `require`, granting the endpoint operator arbitrary code execution in the consumer's Node process on every import. Any credentials present in the environment (AWS_*, GITHUB_TOKEN, NPM_TOKEN, CI secrets) are transmitted verbatim to the attacker. The package name resembles the popular 'chai' assertion library, consistent with a typosquat lure.

Compromised versions (1)

• 2.4.7

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.