MAL-2026-13953

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/js-assert-plus/MAL-2026-13953.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13953
Published
2026-08-13T17:16:55Z
Modified
2026-08-13T17:30:12Z
Summary
Malicious code in js-assert-plus (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (acbf16a8956847ff7ed56158afe65bc0bf76cb36f8cb6af6bc143cae4cb9babe)

The npm package js-assert-plus masquerades as an assertion library (homepage http://js-assert-plus.com) and bundles the real chai source so consumers get working functionality while a loader runs on every require/import. index.js hex-decodes the strings 'child_process' and 'spawn' and spawns a detached node subprocess running lib/chai/utils/assertion.js. That sibling module is packed with obfuscator.io string-array obfuscation (rotated array _0x1b90, base64+decodeURIComponent decoder) that reconstructs a URL at runtime, performs an https GET, and passes the response body to new Function('require', body)(require) — executing attacker-controlled JavaScript on the installer's machine with require in scope. Both the require of child_process and the network destination are hidden behind runtime string reconstruction so static inspection cannot see the endpoint.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017643",
            "import_time": "2026-08-13T17:24:45.732017364Z",
            "modified_time": "2026-08-13T17:16:55Z",
            "sha256": "acbf16a8956847ff7ed56158afe65bc0bf76cb36f8cb6af6bc143cae4cb9babe",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / js-assert-plus

Package

Name
js-assert-plus
View open source insights on deps.dev
Purl
pkg:npm/js-assert-plus

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "9074c70ce1c225f82083ff9d26a0cd7692eddfa18a44f9d5c354426e5a1c35a1",
            "tlsh": "a501c0d11382b9e01c786be5809a6c06b5e0e43170a009b0fbfc52d3ab02a911123eb8"
        },
        {
            "path": "lib/chai/utils/assertion.js",
            "sha256": "46543bececc793d6150af132e1ba48d0be2b61cc22dc2b2408a1ed3e23eeddfb",
            "tlsh": "a391755cad8021915b8f475b3a27f0c4f4096d9f7fc9148fa111bde4e989a24ead6e30"
        },
        {
            "path": "package.json",
            "sha256": "61948780746ced0752a39e8bddb9b4bf945e9f0412ff70997e5f653ec9bdc7ff",
            "tlsh": "48213720cd989ea309c522e9283e411771318e43cd54fc0d37aa175c4f8e56f357ea2e"
        }
    ],
    "package_integrity": [
        {
            "filename": "js-assert-plus-1.0.0.tgz",
            "hashes": {
                "sha1": "c89956aa72a5f37d1377b8b088cf43463497c739",
                "sha512_sri": "sha512-tn5iIv8exiYLuf2M0UwNASoh3ADUoAPUGdfO2vsdmJUW5b/V6hHivPILYa7zu//vDBK5tMPWSMf4w2MEJZmrGQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/js-assert-plus/MAL-2026-13953.json"