Malicious Code Injection in chai-as-relay Package
Summary
MAL-2026-17189: Malicious code in chai-as-relay (npm). Affects chai-as-relay versions 1.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The chai-as-relay package is an npm library designed to facilitate the integration of Relay with Chai assertions. It is intended for developers to enhance testing capabilities in JavaScript applications. However, this package has been compromised, leading to significant security concerns due to the inclusion of malicious code that executes arbitrary commands when the package is imported.
Vulnerability Detail
The vulnerability stems from a malicious code injection in the chai-as-relay package, which unconditionally requires a heavily obfuscated script (lib/config.js) during module loading. This script is a large, self-executing bundle that has no legitimate purpose and allows the attacker to execute arbitrary code on any system that imports the package. The malicious code is hidden within a legitimate-looking package, making it difficult for users to detect the threat. The package masquerades as a legitimate logger, pino, but is actually a dropper for the malicious payload.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall chai-as-relayIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability since the malicious code executes upon requiring the package. The best course of action is to uninstall the package entirely and replace it with a secure alternative.
Conclusion
The chai-as-relay package has been compromised with malicious code that poses a significant security risk. It is essential to uninstall this package and replace it with a secure alternative. Utilizing tools like Vulert can help you monitor your applications for vulnerabilities effectively.
See every vulnerability recorded for chai-as-relay →
FAQ
The malicious code can execute arbitrary commands, potentially compromising the security of your application and the system it runs on.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
There is no patched version available for chai-as-relay. The recommended action is to uninstall the package.
Immediately uninstall the package using npm uninstall chai-as-relay and replace it with a trusted alternative.
Vulert uses your package-lock.json file to monitor and alert you in real-time for any open-source vulnerabilities, ensuring your application remains secure.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
