Malicious Code Vulnerability in chai-as-deploy Package
Summary
MAL-2025-192722: Malicious code in chai-as-deploy (npm). Affects chai-as-deploy versions 2.4.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The chai-as-deploy package is a utility designed for deploying smart contracts in JavaScript applications, particularly those using the Chai assertion library. It provides developers with a streamlined way to manage contract deployment and testing. However, this package has been identified as having a serious vulnerability that could allow malicious code execution, posing a significant risk to applications that rely on it.
Vulnerability Detail
The vulnerability in the chai-as-deploy package arises from the inclusion of malicious code that can execute arbitrary commands on the host system. This issue was reported in version 2.4.1 and is attributed to a malicious actor who has compromised the package. The ramifications of this vulnerability include potential data breaches, unauthorized access to sensitive information, and the ability to manipulate or destroy data within the affected applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall chai-as-deployIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the chai-as-deploy package from your project until a secure version is released. You can do this by running the command: 'npm uninstall chai-as-deploy'. Additionally, review your codebase for any dependencies that might be affected by this vulnerability.
Conclusion
The chai-as-deploy package has been identified as having a critical vulnerability due to the presence of malicious code. It is essential for developers using this package to take immediate action by updating to a secure version or removing the package altogether to protect their applications from potential threats.
See every vulnerability recorded for chai-as-deploy →
FAQ
The chai-as-deploy package is used for deploying smart contracts in JavaScript applications, particularly those that utilize the Chai assertion library.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
If you cannot update the package right away, consider removing it from your project and reviewing your dependencies for any potential risks.
The risks include unauthorized access to sensitive data, potential data breaches, and the ability for attackers to execute arbitrary commands on your system.
The vulnerability was reported by ReversingLabs, a cybersecurity firm specializing in threat detection and analysis.
