Critical Malicious Code Vulnerability in chai-prop Package
Summary
MAL-2026-856: Malicious code in chai-prop (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The chai-prop package is a utility for the Chai assertion library, commonly used in JavaScript testing frameworks. It allows developers to create custom assertions for object properties, enhancing the testing experience. However, this package has been compromised, leading to significant security concerns for any application utilizing it.
Vulnerability Detail
The vulnerability stems from the presence of malicious code embedded within the chai-prop package. This code can fully compromise any computer that has the package installed, allowing external entities to gain control over the system. As a result, all sensitive information, such as secrets and keys, stored on the affected computer may be at risk. The origin of this malicious code is linked to a known malware source, making it imperative for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall chai-propIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no workarounds that can mitigate the risks associated with the malicious code in the chai-prop package. The only recommended action is to uninstall the package entirely.
Conclusion
The discovery of malicious code in the chai-prop package poses a serious threat to users and their systems. Immediate action is required to uninstall the package and secure any compromised information. Regular monitoring of dependencies is essential to prevent similar vulnerabilities in the future.
See every vulnerability recorded for chai-prop →
FAQ
Chai-prop is a utility for the Chai assertion library, used for creating custom assertions in JavaScript testing.
The malicious code can compromise your system, allowing external entities to gain control and access sensitive information.
You should immediately uninstall the chai-prop package and rotate any sensitive information stored on your system.
No, there is currently no patched version available for the chai-prop package. Complete removal is necessary.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can check your application for vulnerabilities using the Vulert playground without any signup.
