Malicious Code Vulnerability in chai-await-cli: A Threat to npm Users
Summary
MAL-2026-1674: Malicious code in chai-await-cli (npm). Affects chai-await-cli versions 2.3.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
chai-await-cli is an npm package designed to facilitate the use of asynchronous testing in JavaScript applications. It allows developers to write tests that can handle promises and async/await syntax seamlessly. However, the package has been identified to contain malicious code, posing significant risks to users who rely on it for their testing needs.
Vulnerability Detail
The vulnerability stems from the inclusion of malicious code within the chai-await-cli package, specifically in version 2.3.5. This code can potentially compromise the security of applications that utilize this package, leading to unauthorized access, data breaches, or other malicious activities. The origin of this vulnerability is linked to the package being compromised, which can have severe ramifications for developers and organizations that integrate it into their projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall chai-await-cliIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can avoid using the chai-await-cli package until a secure version is released. Alternatively, consider using other testing libraries that do not have known vulnerabilities.
Conclusion
The discovery of malicious code in the chai-await-cli package highlights the importance of vigilance when using open-source software. Users are encouraged to update their packages regularly and utilize tools like Vulert to monitor for vulnerabilities. By taking proactive measures, developers can safeguard their applications against potential threats.
See every vulnerability recorded for chai-await-cli →
FAQ
chai-await-cli is an npm package that helps developers write asynchronous tests in JavaScript applications.
The malicious code can compromise the security of applications using the package, potentially leading to unauthorized access or data breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check your application without needing to sign up.
If you are using version 2.3.5 of chai-await-cli, you should update to a patched version immediately to mitigate the risk.
Yes, consider using other testing libraries that provide similar functionality without the associated risks.
