Malicious Code Vulnerability in chai-sync Package
Summary
MAL-2025-191567: Malicious code in chai-sync (npm). Affects chai-sync versions 2.2.4 – 2.2.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The chai-sync package is a tool used in the JavaScript ecosystem, particularly within Node.js applications, to facilitate synchronous assertions in testing. It allows developers to write tests that are easier to read and maintain. However, certain versions of this package have been found to contain malicious code, posing a significant risk to applications that rely on it.
Vulnerability Detail
The vulnerability in the chai-sync package stems from the inclusion of malicious code that can compromise the integrity of applications using this package. This code can lead to unauthorized access, data breaches, or other malicious activities. The affected versions are 2.2.4 and 2.2.6, which were identified by security researchers at ReversingLabs. The malicious code can execute harmful actions without the user's consent, making it critical for developers to address this issue promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall chai-syncIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the affected versions of chai-sync (2.2.4 and 2.2.6) and switch to an alternative testing library that does not have known vulnerabilities. Additionally, you can monitor your dependencies using tools like Vulert, which can alert you to vulnerabilities in real-time.
Conclusion
The discovery of malicious code in the chai-sync package highlights the importance of regularly monitoring and updating dependencies in software projects. Developers should take immediate action to update to a secure version and consider using tools like Vulert to stay informed about vulnerabilities in their applications.
See every vulnerability recorded for chai-sync →
FAQ
The affected versions are 2.2.4 and 2.2.6.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update the package immediately, consider using an alternative library or monitoring your dependencies for any changes using tools like Vulert.
The vulnerability was discovered by security researchers at ReversingLabs.
Using the affected versions can lead to unauthorized access, data breaches, and other malicious activities that can compromise your application.
