chai-plugin-helpernpm
chai-plugin-helper is a confirmed malicious npm package (MAL-2026-5905) that typosquats a legitimate package to trick installs (malicious versions 1.7.3, 1.7.4, 1.7.5…). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in chai-plugin-helper (npm)
What this malware does
chai-plugin-helper poses as a chai plugin and ships a verbatim copy of chai's public API (index.js, lib/chai.js, expect/should/assert exports, version string '4.3.8', description copied from chai) so it functions as a drop-in replacement. On require('chai-plugin-helper'), index.js line 8 spawns a detached background node process that runs lib/chai/utils/assertion.js: const child = spawn("node", [assertion, JSON.stringify(args)], { detached: true, stdio: "ignore" }). assertion.js is obfuscator.io-encoded with a rotated 31-entry string array decoded via a base64+URI-decode chain and hex-named identifiers (_0x479d3b, _0x4a30, etc.). After deobfuscation, the file performs an HTTP(S) GET to a URL built from the encoded constants and passes the response body into new Function(_0x154837[...],_0x375b9e) invoked with the installer's require — executing attacker-controlled remote code with full Node privileges. The copyright header has been altered to 'Anton Lane' while the rest of chai's source is copied verbatim, so installers see a working assertion library and do not notice the dropper running in the background. Combination of namespace impersonation, drop-in API, obfuscation specifically wrapping the fetch+exec path, and remote-code execution at require-time is unambiguous supply-chain attack.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
TyposquatFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for chai-plugin-helper (4 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging chai-plugin-helper across your stack and pipelines.
If you installed it — respond
chai-plugin-helper is a typosquat — you almost certainly intended a legitimately-named package. Remove chai-plugin-helper, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If chai-plugin-helper was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks chai-plugin-helper before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks chai-plugin-helper-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.