Malicious Code Vulnerability in chai-chai-chain-promised Package
Summary
MAL-2026-1676: Malicious code in chai-chai-chain-promised (npm). Affects chai-chai-chain-promised versions 2.4.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The chai-chai-chain-promised package is an npm library that extends the capabilities of the Chai assertion library, allowing for more flexible and powerful promise-based assertions. It is commonly used in testing frameworks to enhance the readability and maintainability of test code. However, this package has been identified as containing malicious code that poses a significant security risk to applications relying on it.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code in version 2.4.3 of the chai-chai-chain-promised package. This code can potentially compromise the integrity of applications using the package, leading to unauthorized access, data breaches, or other malicious activities. The specific technical aspects of the vulnerability have not been disclosed, but it is crucial for users to be aware of the risks associated with using this compromised version.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall chai-chai-chain-promisedIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the chai-chai-chain-promised package from your project until a secure version is released. You can do this by running the following command: npm uninstall chai-chai-chain-promised. Alternatively, consider using a different assertion library that does not have known vulnerabilities.
Conclusion
The discovery of malicious code in the chai-chai-chain-promised package highlights the importance of maintaining vigilance regarding open-source dependencies. Users should promptly update or remove affected packages to safeguard their applications from potential threats.
See every vulnerability recorded for chai-chai-chain-promised →
FAQ
It is an npm library that enhances the Chai assertion library for promise-based assertions in testing.
The malicious code can compromise application integrity, potentially leading to unauthorized access or data breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
Yes, it is recommended to update to a patched version of the package as soon as it is available.
Consider removing the package or using an alternative library until a secure version is released.
