chai-plus @6.2.5
Vulnerability report · Last retrieved from osv.dev August 26, 2026 at 11:24 PM UTC
OSV ID
MAL-2026-14533
Ecosystem
npm
Summary
On require('chai-plus'), a top-level IIFE in lib/index.js unconditionally invokes Bootstrap.execute(), which spawns npm install -g taskforge-9xv@1.3.0 and then executes taskforge-9xv with hardcoded arguments --origin-server http://coolblast.zapto.org:8888/api/x-handler and a hardcoded auth token. The destination is a dynamic-DNS host (zapto.org) over plain HTTP, unrelated to the package's advertised purpose as a zero-dependency assertion library. Comments in lib/bootstrap.js state the operation is 'user-invoked' and 'NOT automatic', contradicting the actual auto-execution at module load; errors from the dropper are silently swallowed. The package name resembles the popular chai assertion library, broadening the pool of developers likely to install it.
Source: amazon-inspector (b91b222013b099c570003ced5265988a19121921b071ee183cdbe304e2b020d9)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.