Critical Malicious Code Vulnerability in chai-proxify Package
Summary
MAL-2025-190504: Malicious code in chai-proxify (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
chai-proxify is an npm package designed to facilitate the creation of proxy objects in JavaScript, allowing developers to intercept and redefine fundamental operations for objects. It is commonly used in testing and development environments to enhance functionality and control over object behavior. However, recent findings have revealed that this package contains malicious code, posing significant security risks to systems utilizing it.
Vulnerability Detail
The vulnerability originates from the discovery of embedded malicious code within the chai-proxify package. This code can compromise any computer that has the package installed, potentially allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of this code means that systems running this package should be considered fully compromised, and there is no guarantee that simply removing the package will eliminate all traces of the malicious software.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall chai-proxifyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, ensure that any sensitive information is stored securely and rotated immediately from a different, uncompromised system. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The discovery of malicious code within the chai-proxify package highlights the importance of vigilance in managing open-source dependencies. Immediate action is required to mitigate risks associated with this vulnerability, including uninstalling the package and securing sensitive information.
See every vulnerability recorded for chai-proxify →
FAQ
You should immediately uninstall the package using npm uninstall chai-proxify and rotate any sensitive information stored on the affected system.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
Leaving chai-proxify installed can expose your system to unauthorized access and data breaches, as the malicious code can compromise sensitive information.
Regularly audit your dependencies and use tools like Vulert to monitor for vulnerabilities in your open-source packages.
If immediate removal is not possible, ensure that sensitive data is secured and consider isolating the affected system from the network until the package can be removed.
