MAL-2026-13954

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/minimalistic-assert-plus/MAL-2026-13954.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13954
Published
2026-08-13T17:16:48Z
Modified
2026-08-13T17:30:12.626973492Z
Summary
Malicious code in minimalistic-assert-plus (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e59f4af9a6f3f95bf4cf795fb91bcf4c7934dbb90e64d750255a2a786ed7dc75)

The package typosquats minimalistic-assert and re-ships the Chai library alongside a malicious dispatcher. On require('minimalistic-assert-plus'), index.js spawns a detached Node child (spawn('node', [assertion,...], {detached:true, stdio:'ignore'})) that runs lib/chai/utils/expectAssertion.js. That file is heavily obfuscated (obfuscator.io string-array + base64 rotation, hex-named identifiers such as _0x4b784f, _0x51bd34) and at runtime constructs an HTTP URL, performs an http.get, and passes the response body to new Function(..., body)(require) — evaluating attacker-supplied JavaScript with the real Node require in scope. Stdio is ignored and the process is detached to evade observation. Package metadata is deceptive: name mimics minimalistic-assert, description is copied from Chai, and homepage points to minimalistic-assert-plus.com.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017642",
            "import_time": "2026-08-13T17:24:45.642929092Z",
            "sha256": "e59f4af9a6f3f95bf4cf795fb91bcf4c7934dbb90e64d750255a2a786ed7dc75",
            "versions": [
                "1.1.7"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-13T17:16:48Z"
        }
    ]
}
References
Credits

Affected packages

npm / minimalistic-assert-plus

Package

Name
minimalistic-assert-plus
View open source insights on deps.dev
Purl
pkg:npm/minimalistic-assert-plus

Affected ranges

Affected versions

1.*
1.1.7

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/chai/utils/expectAssertion.js",
            "tlsh": "a391755cad8021915b8f475b3a27f0c4f4096d9f7fc9148fa111bde4e989a24ead6e30",
            "sha256": "46543bececc793d6150af132e1ba48d0be2b61cc22dc2b2408a1ed3e23eeddfb"
        },
        {
            "path": "package.json",
            "tlsh": "3f213720ce599ea30ad823e9246e001771318e438954fc1d37ea175d8f8e0af357ea6e",
            "sha256": "6bbc22527b51ce09632f50b8fd04d207d224097d9f32d3825e6a8e01df996345"
        }
    ],
    "package_integrity": [
        {
            "filename": "minimalistic-assert-plus-1.1.7.tgz",
            "hashes": {
                "sha512_sri": "sha512-WmDdA25J+I1F2wP5lihVc87rq1ot8T6+JqN6FVMFGQqgeUYc8YHq0ZwhWyb9Z4wnHYQHUZWsgyQpPWQTBtDM4Q==",
                "sha1": "7599f50efcacacc0ccaf0f77e8e93d92113604ec"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/minimalistic-assert-plus/MAL-2026-13954.json"