react-vite-assert

{"modified":"2026-06-16T22:20:27Z","published":"2026-06-16T22:20:27Z","schema_version":"1.7.4","id":"MAL-2026-5933","summary":"Malicious code in react-vite-assert (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (746aecfafda9a8f780b53ef40a5697875c52514dfa6ebb29306992ad06128395)\nreact-vite-assert@1.4.1 executes attacker-controlled JavaScript whenever the package is imported. The main entry transitively loads src/features/extras/config.js, which runs a top-level async IIFE that issues an HTTPS GET to https://www.jsonkeeper.com/b/HXDNM, takes the `data.config` string from the response, wraps it with `new Function('require', s)`, and invokes it with a `createRequire(import.meta.url)`-built `require` — granting the fetched code full Node.js access (filesystem, network, child_process, env). The fetch is retried up to 5 times. The remote URL and request headers are disguised by a fake local `process` shadow object whose keys are named DEV_API_KEY/DEV_SECRET_KEY/DEV_SECRET_VALUE, where DEV_API_KEY actually holds the paste URL and the other two hold a request header name/value — deliberate misdirection rather than configuration. jsonkeeper.com is an anonymous, mutable paste host: whoever controls /b/HXDNM can change the executed payload at any time without republishing the package. The combination of import-time auto-execution, anonymous mutable code source, eval of fetched bytes with full `require`, and cover-story variable naming is unambiguous supply-chain attack tradecraft.\n","affected":[{"package":{"ecosystem":"npm","name":"react-vite-assert"},"versions":["1.4.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/features/extras/config.js","sha256":"d2c9cc973ef588acad719b4a4d8dcd6d088f224450b9ef9eeb717b8c9f3d64ba","tlsh":"e601bd8fa1ac140c057013e7bb1be036f662b1ab390381d5775cc7521fb695ca602ede"}],"package_integrity":[{"filename":"react-vite-assert-1.4.1.tgz","hashes":{"sha1":"d6bd02f9d25ef59286509f280f9ad7fe410373f6","sha512_sri":"sha512-yQR1Zt0WASthdm81PWQVuMCoqnB1jQpWg/rhwloh8wUN7Jc2018x4KgfnHEVrgLsP99bJPUTz5tf1ybIw5otyQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/react-vite-assert/v/1.4.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-006845","import_time":"2026-06-16T23:03:43.547587086Z","modified_time":"2026-06-16T22:20:27Z","sha256":"746aecfafda9a8f780b53ef40a5697875c52514dfa6ebb29306992ad06128395","source":"amazon-inspector","versions":["1.4.1"]}]}}