MAL-2026-13953

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/js-assert-plus/MAL-2026-13953.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13953
Published
2026-08-13T17:16:55Z
Modified
2026-08-13T17:30:12.653650311Z
Summary
Malicious code in js-assert-plus (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (acbf16a8956847ff7ed56158afe65bc0bf76cb36f8cb6af6bc143cae4cb9babe)

The npm package js-assert-plus masquerades as an assertion library (homepage http://js-assert-plus.com) and bundles the real chai source so consumers get working functionality while a loader runs on every require/import. index.js hex-decodes the strings 'child_process' and 'spawn' and spawns a detached node subprocess running lib/chai/utils/assertion.js. That sibling module is packed with obfuscator.io string-array obfuscation (rotated array 0x1b90, base64+decodeURIComponent decoder) that reconstructs a URL at runtime, performs an https GET, and passes the response body to new Function('require', body)(require) — executing attacker-controlled JavaScript on the installer's machine with require in scope. Both the require of childprocess and the network destination are hidden behind runtime string reconstruction so static inspection cannot see the endpoint.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017643",
            "modified_time": "2026-08-13T17:16:55Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2026-08-13T17:24:45.732017364Z",
            "sha256": "acbf16a8956847ff7ed56158afe65bc0bf76cb36f8cb6af6bc143cae4cb9babe"
        }
    ]
}
References
Credits

Affected packages

npm / js-assert-plus

Package

Name
js-assert-plus
View open source insights on deps.dev
Purl
pkg:npm/js-assert-plus

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "9074c70ce1c225f82083ff9d26a0cd7692eddfa18a44f9d5c354426e5a1c35a1",
            "tlsh": "a501c0d11382b9e01c786be5809a6c06b5e0e43170a009b0fbfc52d3ab02a911123eb8"
        },
        {
            "path": "lib/chai/utils/assertion.js",
            "sha256": "46543bececc793d6150af132e1ba48d0be2b61cc22dc2b2408a1ed3e23eeddfb",
            "tlsh": "a391755cad8021915b8f475b3a27f0c4f4096d9f7fc9148fa111bde4e989a24ead6e30"
        },
        {
            "path": "package.json",
            "sha256": "61948780746ced0752a39e8bddb9b4bf945e9f0412ff70997e5f653ec9bdc7ff",
            "tlsh": "48213720cd989ea309c522e9283e411771318e43cd54fc0d37aa175c4f8e56f357ea2e"
        }
    ],
    "package_integrity": [
        {
            "filename": "js-assert-plus-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-tn5iIv8exiYLuf2M0UwNASoh3ADUoAPUGdfO2vsdmJUW5b/V6hHivPILYa7zu//vDBK5tMPWSMf4w2MEJZmrGQ==",
                "sha1": "c89956aa72a5f37d1377b8b088cf43463497c739"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/js-assert-plus/MAL-2026-13953.json"