minimalistic-assert-plus

{"modified":"2026-08-13T17:16:48Z","published":"2026-08-13T17:16:48Z","schema_version":"1.7.4","id":"MAL-2026-13954","summary":"Malicious code in minimalistic-assert-plus (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e59f4af9a6f3f95bf4cf795fb91bcf4c7934dbb90e64d750255a2a786ed7dc75)\nThe package typosquats `minimalistic-assert` and re-ships the Chai library alongside a malicious dispatcher. On `require('minimalistic-assert-plus')`, index.js spawns a detached Node child (`spawn('node', [assertion,...], {detached:true, stdio:'ignore'})`) that runs lib/chai/utils/expectAssertion.js. That file is heavily obfuscated (obfuscator.io string-array + base64 rotation, hex-named identifiers such as _0x4b784f, _0x51bd34) and at runtime constructs an HTTP URL, performs an `http.get`, and passes the response body to `new Function(..., body)(require)` — evaluating attacker-supplied JavaScript with the real Node `require` in scope. Stdio is ignored and the process is detached to evade observation. Package metadata is deceptive: name mimics `minimalistic-assert`, description is copied from Chai, and homepage points to `minimalistic-assert-plus.com`.\n","affected":[{"package":{"ecosystem":"npm","name":"minimalistic-assert-plus"},"versions":["1.1.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/chai/utils/expectAssertion.js","sha256":"46543bececc793d6150af132e1ba48d0be2b61cc22dc2b2408a1ed3e23eeddfb","tlsh":"a391755cad8021915b8f475b3a27f0c4f4096d9f7fc9148fa111bde4e989a24ead6e30"},{"path":"package.json","sha256":"6bbc22527b51ce09632f50b8fd04d207d224097d9f32d3825e6a8e01df996345","tlsh":"3f213720ce599ea30ad823e9246e001771318e438954fc1d37ea175d8f8e0af357ea6e"}],"package_integrity":[{"filename":"minimalistic-assert-plus-1.1.7.tgz","hashes":{"sha1":"7599f50efcacacc0ccaf0f77e8e93d92113604ec","sha512_sri":"sha512-WmDdA25J+I1F2wP5lihVc87rq1ot8T6+JqN6FVMFGQqgeUYc8YHq0ZwhWyb9Z4wnHYQHUZWsgyQpPWQTBtDM4Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/minimalistic-assert-plus/v/1.1.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017642","import_time":"2026-08-13T17:24:45.642929092Z","modified_time":"2026-08-13T17:16:48Z","sha256":"e59f4af9a6f3f95bf4cf795fb91bcf4c7934dbb90e64d750255a2a786ed7dc75","source":"amazon-inspector","versions":["1.1.7"]}]}}