Malicious Code Vulnerability in chai-pack: A Threat to npm Users
Summary
MAL-2025-192725: Malicious code in chai-pack (npm). Affects chai-pack versions 5.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
chai-pack is a package in the npm ecosystem that provides utilities for testing with the Chai assertion library. It is commonly used in JavaScript applications to facilitate unit testing and ensure code quality. However, this package has been identified to contain malicious code, posing a significant risk to users who rely on it for their testing needs.
Vulnerability Detail
The vulnerability in chai-pack stems from the inclusion of malicious code that can compromise the security of applications using this package. This code may lead to unauthorized access, data breaches, or other malicious activities. The issue was reported by ReversingLabs, highlighting the importance of scrutinizing dependencies for potential threats.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall chai-packIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the chai-pack package from your project until a secure version is available. You can do this by executing: 'npm uninstall chai-pack'. Additionally, monitor your application for any unusual behavior that may indicate exploitation of this vulnerability.
Conclusion
The discovery of malicious code in the chai-pack package poses a serious risk to npm users. It is crucial to stay informed about such vulnerabilities and take proactive measures to secure your applications. Regularly updating dependencies and utilizing tools like Vulert can help mitigate these risks.
See every vulnerability recorded for chai-pack →
FAQ
The malicious code can potentially allow unauthorized access to your application, leading to data breaches or other security incidents.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability affects version 5.1.0 of chai-pack. Always check for the latest version and update accordingly.
Consider removing the package from your project as a temporary measure and monitor your application for any suspicious activity.
The vulnerability was reported by ReversingLabs, a cybersecurity firm specializing in threat detection.
