Malicious Code Detected in avior-chai-html-webpack-plugin-pegasus: A Critical Security Alert
Summary
MAL-2025-15203: Malicious code in avior-chai-html-webpack-plugin-pegasus (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package avior-chai-html-webpack-plugin-pegasus is an npm module designed to facilitate the integration of Chai HTML assertions with Webpack. It aims to enhance testing capabilities by allowing developers to assert HTML output in their applications. However, this package has been identified to contain malicious code, posing significant security risks to users who incorporate it into their projects.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the avior-chai-html-webpack-plugin-pegasus package. This code can potentially lead to unauthorized access, data breaches, or the execution of harmful operations within the user's environment. The malicious nature of this code was discovered through security audits and analysis, highlighting the importance of scrutinizing third-party packages before use.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall avior-chai-html-webpack-plugin-pegasusIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider using alternative packages that offer similar functionality without the associated risks. Always review the package's repository and issues for any reported vulnerabilities before integrating it into your project.
Conclusion
The discovery of malicious code in the avior-chai-html-webpack-plugin-pegasus package underscores the importance of vigilance when using third-party libraries. Users are advised to remove the affected package and consider alternatives while also utilizing tools like Vulert to monitor for vulnerabilities in their projects.
See every vulnerability recorded for avior-chai-html-webpack-plugin-pegasus →
FAQ
It is an npm package that integrates Chai HTML assertions with Webpack for enhanced testing capabilities.
The malicious code was identified through security audits conducted by researchers and tools like Amazon Inspector.
Using this package can lead to unauthorized access, data breaches, and execution of harmful operations in your environment.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
