Malicious Code Vulnerability in chai-promised-async Package
Summary
MAL-2026-1679: Malicious code in chai-promised-async (npm). Affects chai-promised-async versions 2.4.3 – 3.3.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
chai-promised-async is an npm package designed to enhance the functionality of Chai assertions by allowing asynchronous promises to be tested seamlessly. It is widely used in JavaScript testing environments to improve code reliability and maintainability. However, recent findings have revealed that certain versions of this package contain malicious code that could compromise the security of applications utilizing it.
Vulnerability Detail
The vulnerability stems from malicious code embedded within specific versions of the chai-promised-async package (2.4.3 and 3.3.5). This code could potentially allow unauthorized access to sensitive data or enable remote code execution, posing significant risks to applications that rely on this package. The issue was identified by ReversingLabs, highlighting the importance of scrutinizing dependencies for security threats.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall chai-promised-asyncIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the chai-promised-async package from your project until a secure version is confirmed. Use the following command to uninstall the package:
npm uninstall chai-promised-async
Consider using alternative assertion libraries that do not have known vulnerabilities.
Conclusion
The discovery of malicious code in specific versions of the chai-promised-async package underscores the importance of maintaining secure dependencies in software development. By updating to a patched version or removing the package, developers can mitigate the risks associated with this vulnerability.
See every vulnerability recorded for chai-promised-async →
FAQ
chai-promised-async is an npm package that extends Chai assertions to support asynchronous promises, making it easier to test asynchronous code.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can identify if your application is affected by this vulnerability.
If immediate updates are not feasible, consider removing the package temporarily and using alternative libraries until a secure version is available.
Detailed information about this vulnerability can be found on the GitHub repository of the malicious packages, as well as through security advisories from ReversingLabs.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
