MAL-2026-13704

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-tracker/MAL-2026-13704.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13704
Published
2026-08-10T12:29:01Z
Modified
2026-08-10T13:04:59.898749150Z
Summary
Malicious code in chai-tracker (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d61869c26ad8015b88350d312fa37f5e18d536794ce5d8c46bf4239b2154b1a9)

chai-tracker mimics chai-spies (matching name, README, and keywords) but declares peerDependencies on dbconnectify pinned to 'latest' and axios. The exported chai plugin function, invoked when a consumer calls chai.use(require('chai-tracker')), unconditionally calls a helper named assertConnection() placed between genuine Assertion.overwriteMethod definitions. Despite the name, assertConnection() performs no assertion — it spawns a detached child (spawn(process.execPath, ['-e', code], { stdio: 'ignore', detached: true })) whose inline code does require('dbconnectify') and calls new DxDatabaseConnector({}).queryDBConnect(). Because dbconnectify is a separately-published, unversioned ('latest') attacker-controlled package and the child is detached with stdio ignored, arbitrary code from that dependency executes on the installer's host at plugin load time with output suppressed. The cover-story naming and placement disguise the exec as part of chai method registration.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017261",
            "import_time": "2026-08-10T12:51:44.813391486Z",
            "sha256": "12a7bbd6d78534877f788d24df2bcc7b62ec10c5b56b2bd218d7cb25edb4b8ca",
            "versions": [
                "1.2.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-10T12:29:01Z"
        },
        {
            "import_time": "2026-08-10T12:51:44.894166099Z",
            "id": "IN-MAL-2026-017263",
            "sha256": "3ab2d9f276d6fb4a594c7e8b395c390ce7d73828e4756214a008a7e981a64539",
            "modified_time": "2026-08-10T12:29:18Z",
            "source": "amazon-inspector",
            "versions": [
                "1.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017265",
            "import_time": "2026-08-10T12:51:44.996275021Z",
            "sha256": "86283c9d77d09bb74e1740b9e82054c894450ed060e09afc5aae14cc973e8660",
            "modified_time": "2026-08-10T12:29:36Z",
            "source": "amazon-inspector",
            "versions": [
                "1.1.1"
            ]
        },
        {
            "import_time": "2026-08-10T12:51:44.930572418Z",
            "id": "IN-MAL-2026-017264",
            "sha256": "94d712ff478a98bdc7c5b7b2fb76a0c79fb85378ffc15741aa1e77688e515718",
            "modified_time": "2026-08-10T12:29:27Z",
            "source": "amazon-inspector",
            "versions": [
                "1.1.2"
            ]
        },
        {
            "id": "IN-MAL-2026-017262",
            "import_time": "2026-08-10T12:51:44.849446509Z",
            "sha256": "d61869c26ad8015b88350d312fa37f5e18d536794ce5d8c46bf4239b2154b1a9",
            "modified_time": "2026-08-10T12:29:09Z",
            "source": "amazon-inspector",
            "versions": [
                "1.1.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / chai-tracker

Package

Name
chai-tracker
View open source insights on deps.dev
Purl
pkg:npm/chai-tracker

Affected ranges

Affected versions

1.*
1.1.0
1.1.1
1.1.2
1.1.3
1.2.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/spy.js",
            "tlsh": "9e92334922d371a0c6a3b37c0e2f64a8e023861f1099dd593dece2dc6f98e754695cf9",
            "sha256": "e31d0b8dc56858829800f14ed45b3e08be9b98bf98b1c4352e38a08342e667a3"
        },
        {
            "path": "package.json",
            "tlsh": "51115964cb788d2315d861a8947a0197713589079e59fc1d73b3810c9f0d92f20fad6c",
            "sha256": "cbbbfd737b6d94ddf658e65678de3192b2fbb8140d3bd0ea0f65d87adc16034b"
        }
    ],
    "package_integrity": [
        {
            "filename": "chai-tracker-1.2.1.tgz",
            "hashes": {
                "sha1": "7f03147d555745361eafab8a7b4c370a0b020488",
                "sha512_sri": "sha512-a2Vn/k7TSh6+L/CgKaLzeDwney7vQAukw+UPU85gzFz4dXUNbpxE2T7B/7eCjEOUjc61chBuD6+njWpn/sClow=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-tracker/MAL-2026-13704.json"