Skip to content

2026-02-05 — NPM package chai-as-advanced flagged as malware (GHSA-hw5g-4gvf-c7vh)

Summary

GitHub has published a malware advisory for the NPM package chai-as-advanced.

“Any computer that has this package installed or running should be considered fully compromised.”

  • Advisory: https://github.com/advisories/GHSA-hw5g-4gvf-c7vh
  • Ecosystem: npm
  • Affected versions: >= 0
  • Patched versions: none

What to do (durable guidance)

If you find chai-as-advanced installed anywhere (directly or as a transitive dependency), treat it as an incident.

Immediate actions

  1. Contain
  2. Stop affected workloads (CI runner, dev machine, container, server).

  3. Preserve evidence (process list, network connections, install logs, lockfiles).

  4. Identify exposure

  5. Search across:
    • package.json
    • package-lock.json / yarn.lock / pnpm-lock.yaml
    • build images and caches

  6. Check whether it could have executed install hooks (preinstall/install/postinstall).

  7. Rotate secrets from a clean machine

  8. CI tokens, cloud credentials, SSH keys, registry tokens, app secrets.

  9. Rebuild clean

  10. Prefer re-imaging (don’t rely on “remove the package” as remediation).

Longer-term hardening

  • Prefer ephemeral CI runners; avoid shared caches for sensitive steps.
  • Consider npm --ignore-scripts where feasible.
  • Use lockfiles and review dependency diffs.
  • Generate SBOMs and scan/attest builds.