# Risk map — chaijs/chai

> Canonical page: https://codevetter.com/unpack/chai/risk-map

# Risk map — chaijs/chai

Scanned commit d86de2a9519bdd0d89aa64c9fbcc0e880513b153 (2026-09-29). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The principal observed boundaries are execution of consumer callbacks and getters, shared prototype/configuration mutation, and assertion-error disclosure. Plugins operate with the consumer process's capabilities. Source inspection also identifies recursive subset matching and exception-sensitive flag restoration as areas for targeted investigation. These are observations or explicitly labeled hypotheses, not confirmed vulnerabilities or runtime failures.
- should intentionally modifies Object.prototype, while registration modules assign globalThis properties; these operations affect the embedding realm beyond a single assertion. — [lib/chai/interface/should.js#L33-L52](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/lib/chai/interface/should.js#L33-L52) [register-assert.js#L1-L3](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/register-assert.js#L1-L3) [register-expect.js#L1-L3](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/register-expect.js#L1-L3) [register-should.js#L1-L3](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/register-should.js#L1-L3)
- use directly invokes plugins with shared constructors, utilities, and config; no sandbox or rollback surrounds installation, and the plugin is recorded only after it returns. — [lib/chai.js#L48-L65](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/lib/chai.js#L48-L65) [test/plugins.js#L35-L45](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/test/plugins.js#L35-L45)
- throw, change, satisfy, and subset field validators execute supplied functions synchronously; change retains callback side effects rather than restoring the subject. — [lib/chai/core/assertions.js#L2773-L2780](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/lib/chai/core/assertions.js#L2773-L2780) [lib/chai/core/assertions.js#L3539-L3553](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/lib/chai/core/assertions.js#L3539-L3553) [lib/chai/core/assertions.js#L3073-L3083](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/lib/chai/core/assertions.js#L3073-L3083) [lib/chai/core/assertions.js#L4134-L4147](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/lib/chai/core/assertions.js#L4134-L4147)
- Type detection reads Symbol.toStringTag, property checks read obj[name], and subset comparison reads actual[key]; consumer getters or proxy traps can therefore execute during these reads. — [lib/chai/utils/type-detect.js#L14-L20](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/lib/chai/utils/type-detect.js#L14-L20) [lib/chai/core/assertions.js#L1975-L1979](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/lib/chai/core/assertions.js#L1975-L1979) [lib/chai/core/assertions.js#L4134-L4136](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/lib/chai/core/assertions.js#L4134-L4136)
- Failure output includes actual and expected references plus rendered values; truncateThreshold limits display text, but AssertionError metadata still receives the original values. — [lib/chai/assertion.js#L163-L182](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/lib/chai/assertion.js#L163-L182) [lib/chai/utils/getMessage.js#L44-L54](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/lib/chai/utils/getMessage.js#L44-L54) [lib/chai/utils/inspect.js#L23-L30](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/lib/chai/utils/inspect.js#L23-L30)
- Hypothesis: distinct cyclic expected/actual graphs can exhaust recursion in compareSubset because recursive branches have no visited-pair tracking; the inspected circular tests use finite expected structures. (inferred) — [lib/chai/core/assertions.js#L4101-L4149](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/lib/chai/core/assertions.js#L4101-L4149) [test/subset.js#L97-L116](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/test/subset.js#L97-L116)
- Hypothesis: reusing an Assertion after catching an exception from a deep-equality or overwritten-method call can retain lockSsfi=true, because restoration occurs after the call without finally. (inferred) — [lib/chai/core/assertions.js#L1120-L1124](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/lib/chai/core/assertions.js#L1120-L1124) [lib/chai/utils/overwriteMethod.js#L79-L82](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/lib/chai/utils/overwriteMethod.js#L79-L82)
- Verification gaps are visible in configuration: default suites omit nested type-detect files, the Deno fixture imports ../index.ts absent from the tracked inventory, and Node CI's matrix does not directly exercise the advertised Node 18 floor. — [package.json#L40-L41](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/package.json#L40-L41) [package.json#L53-L55](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/package.json#L53-L55) [test/type-detect/deno-test.ts#L1-L7](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/test/type-detect/deno-test.ts#L1-L7) [.github/workflows/node.js.yml#L32-L37](https://github.com/chaijs/chai/blob/d86de2a9519bdd0d89aa64c9fbcc0e880513b153/.github/workflows/node.js.yml#L32-L37)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)