Critical Malicious Code Vulnerability in chai-async Package
Summary
MAL-2025-192623: Malicious code in chai-async (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
chai-async is an npm package designed to facilitate asynchronous testing in JavaScript, providing a set of utilities that enhance the capabilities of the Chai assertion library. It allows developers to write cleaner and more manageable tests for asynchronous code. However, the package has been compromised, leading to significant security concerns.
Vulnerability Detail
The vulnerability stems from the presence of malicious code embedded within the chai-async package. This code can fully compromise any computer that has the package installed, allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of the code is classified under CWE-506, indicating that it contains code that appears to be malicious in nature. Users should treat any system with this package as fully compromised and take immediate action to secure their data.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall chai-asyncIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, consider using alternative packages for asynchronous testing that do not have known vulnerabilities. Always ensure to review the security status of packages before installation.
Conclusion
The discovery of malicious code in the chai-async package poses a serious threat to users and their systems. Immediate action is required to mitigate risks, including uninstalling the package and securing sensitive information. Regular monitoring and auditing of dependencies are essential to maintain a secure development environment.
See every vulnerability recorded for chai-async →
FAQ
Immediately uninstall the chai-async package and rotate any sensitive information stored on the affected system.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Failing to address this vulnerability can lead to unauthorized access to sensitive data, potentially resulting in data breaches and loss of control over your systems.
Regularly audit your dependencies, use tools like Vulert for monitoring vulnerabilities, and stay updated on security advisories for the packages you use.
It is recommended to find an alternative package for asynchronous testing, as the current version of chai-async is compromised.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
