Malicious Code Injection in chai-as-testmode: A Critical Vulnerability
Summary
MAL-2026-17473: Malicious code in chai-as-testmode (npm). Affects chai-as-testmode versions 1.4.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
chai-as-testmode is an npm package designed to facilitate testing in a controlled environment. It aims to provide developers with tools to simulate various testing scenarios. However, this package has been compromised, masquerading as a legitimate logging library while embedding malicious code that can expose sensitive environment variables.
Vulnerability Detail
The vulnerability originates from a malicious dropper included in the package, specifically in the lib/initializeCaller.js file. This dropper executes a self-invoking function that sends the entire process.env object to a concealed endpoint. The transmitted data may include sensitive tokens and credentials, which can be exploited by attackers. The malicious code is hidden behind a facade of legitimate documentation and package naming, making it difficult for users to detect.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall chai-as-testmodeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the chai-as-testmode package from your project until a secure version is available. You can do this by executing: npm uninstall chai-as-testmode. Additionally, review your environment variables and rotate any exposed credentials.
Conclusion
The chai-as-testmode package has been compromised with a serious vulnerability that can lead to the exposure of sensitive environment variables. It is essential for developers to take immediate action by updating or removing the package to safeguard their applications.
See every vulnerability recorded for chai-as-testmode →
FAQ
The vulnerability involves malicious code that sends sensitive environment variables to an external server, potentially exposing critical credentials.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If you have installed chai-as-testmode, immediately update to the latest patched version or uninstall the package to mitigate risks.
Yes, the vulnerability can expose various environment variables, including NPM_TOKEN, GITHUB_TOKEN, and AWS credentials, which are critical for your application's security.
The malicious code executes a function that sends the entire process environment to a base64-encoded endpoint, allowing attackers to retrieve sensitive information.
