js-assert-plus

{"modified":"2026-08-13T17:16:55Z","published":"2026-08-13T17:16:55Z","schema_version":"1.7.4","id":"MAL-2026-13953","summary":"Malicious code in js-assert-plus (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (acbf16a8956847ff7ed56158afe65bc0bf76cb36f8cb6af6bc143cae4cb9babe)\nThe npm package js-assert-plus masquerades as an assertion library (homepage http://js-assert-plus.com) and bundles the real chai source so consumers get working functionality while a loader runs on every require/import. index.js hex-decodes the strings 'child_process' and 'spawn' and spawns a detached node subprocess running lib/chai/utils/assertion.js. That sibling module is packed with obfuscator.io string-array obfuscation (rotated array _0x1b90, base64+decodeURIComponent decoder) that reconstructs a URL at runtime, performs an https GET, and passes the response body to new Function('require', body)(require) — executing attacker-controlled JavaScript on the installer's machine with require in scope. Both the require of child_process and the network destination are hidden behind runtime string reconstruction so static inspection cannot see the endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"js-assert-plus"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"9074c70ce1c225f82083ff9d26a0cd7692eddfa18a44f9d5c354426e5a1c35a1","tlsh":"a501c0d11382b9e01c786be5809a6c06b5e0e43170a009b0fbfc52d3ab02a911123eb8"},{"path":"lib/chai/utils/assertion.js","sha256":"46543bececc793d6150af132e1ba48d0be2b61cc22dc2b2408a1ed3e23eeddfb","tlsh":"a391755cad8021915b8f475b3a27f0c4f4096d9f7fc9148fa111bde4e989a24ead6e30"},{"path":"package.json","sha256":"61948780746ced0752a39e8bddb9b4bf945e9f0412ff70997e5f653ec9bdc7ff","tlsh":"48213720cd989ea309c522e9283e411771318e43cd54fc0d37aa175c4f8e56f357ea2e"}],"package_integrity":[{"filename":"js-assert-plus-1.0.0.tgz","hashes":{"sha1":"c89956aa72a5f37d1377b8b088cf43463497c739","sha512_sri":"sha512-tn5iIv8exiYLuf2M0UwNASoh3ADUoAPUGdfO2vsdmJUW5b/V6hHivPILYa7zu//vDBK5tMPWSMf4w2MEJZmrGQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/js-assert-plus/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017643","import_time":"2026-08-13T17:24:45.732017364Z","modified_time":"2026-08-13T17:16:55Z","sha256":"acbf16a8956847ff7ed56158afe65bc0bf76cb36f8cb6af6bc143cae4cb9babe","source":"amazon-inspector","versions":["1.0.0"]}]}}