power-assert-plus

{"modified":"2026-08-13T17:16:39Z","published":"2026-08-13T17:16:39Z","schema_version":"1.7.4","id":"MAL-2026-13958","summary":"Malicious code in power-assert-plus (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ff97d4bae356db6a165ae845ee186c814f89bd1ee40e839d6da054965bfbd823)\npower-assert-plus is a typosquat of power-assert. On every require(), index.js detach-spawns `node build/power-assert-plus.js`. That build file is obfuscator.io-encoded (string-array + custom base64 alphabet) and, after decoding, dynamically requires http/https, GETs a remote URL, and passes the response body to `new Function('require', body)(require)`, executing attacker-controlled JavaScript with Node's require in the installer's process context. The README frames build/power-assert-plus.js as a browserify bundle of the library, but the shipped 4KB payload is a network loader with no assertion library code; the module name, host, and eval sink are all hidden behind the string-array decoder.\n","affected":[{"package":{"ecosystem":"npm","name":"power-assert-plus"},"versions":["1.2.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"048001f2b0d88bf40547094e6433c571e201a90415f605d9d1eb04cf40e4aab0","tlsh":"df51cd2c9af5ec741097717c8a1e840b396bce07544d9a35b6ac43511f9487c9a73bac"},{"path":"build/power-assert-plus.js","sha256":"46543bececc793d6150af132e1ba48d0be2b61cc22dc2b2408a1ed3e23eeddfb","tlsh":"a391755cad8021915b8f475b3a27f0c4f4096d9f7fc9148fa111bde4e989a24ead6e30"}],"package_integrity":[{"filename":"power-assert-plus-1.2.2.tgz","hashes":{"sha1":"35442c93882c551919a85c7a5246e253e0b32471","sha512_sri":"sha512-LWbjZ9UjDj9j2pSqR08Vu5DZZIt8H2dUOKW2DBZz3KaaFWtaPJRYCEPNp6YE/Wbwhcy06KRsekUZ5V/7gCN3Eg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/power-assert-plus/v/1.2.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017641","import_time":"2026-08-13T17:24:45.593019958Z","modified_time":"2026-08-13T17:16:39Z","sha256":"ff97d4bae356db6a165ae845ee186c814f89bd1ee40e839d6da054965bfbd823","source":"amazon-inspector","versions":["1.2.2"]}]}}