MAL-2026-13958

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/power-assert-plus/MAL-2026-13958.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-13958

Published

2026-08-13T17:16:39Z

Modified

2026-08-13T17:30:13.435946787Z

Summary

Malicious code in power-assert-plus (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ff97d4bae356db6a165ae845ee186c814f89bd1ee40e839d6da054965bfbd823)

power-assert-plus is a typosquat of power-assert. On every require(), index.js detach-spawns node build/power-assert-plus.js. That build file is obfuscator.io-encoded (string-array + custom base64 alphabet) and, after decoding, dynamically requires http/https, GETs a remote URL, and passes the response body to new Function('require', body)(require), executing attacker-controlled JavaScript with Node's require in the installer's process context. The README frames build/power-assert-plus.js as a browserify bundle of the library, but the shipped 4KB payload is a network loader with no assertion library code; the module name, host, and eval sink are all hidden behind the string-array decoder.

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017641",
            "import_time": "2026-08-13T17:24:45.593019958Z",
            "sha256": "ff97d4bae356db6a165ae845ee186c814f89bd1ee40e839d6da054965bfbd823",
            "modified_time": "2026-08-13T17:16:39Z",
            "source": "amazon-inspector",
            "versions": [
                "1.2.2"
            ]
        }
    ]
}

References

https://www.npmjs.com/package/power-assert-plus/v/1.2.2

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / power-assert-plus

Package

Name: power-assert-plus; View open source insights on deps.dev
Purl: pkg:npm/power-assert-plus

Affected ranges

Affected versions

1.*

1.2.2

Database specific

cwes

[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "df51cd2c9af5ec741097717c8a1e840b396bce07544d9a35b6ac43511f9487c9a73bac",
            "sha256": "048001f2b0d88bf40547094e6433c571e201a90415f605d9d1eb04cf40e4aab0"
        },
        {
            "path": "build/power-assert-plus.js",
            "tlsh": "a391755cad8021915b8f475b3a27f0c4f4096d9f7fc9148fa111bde4e989a24ead6e30",
            "sha256": "46543bececc793d6150af132e1ba48d0be2b61cc22dc2b2408a1ed3e23eeddfb"
        }
    ],
    "package_integrity": [
        {
            "filename": "power-assert-plus-1.2.2.tgz",
            "hashes": {
                "sha1": "35442c93882c551919a85c7a5246e253e0b32471",
                "sha512_sri": "sha512-LWbjZ9UjDj9j2pSqR08Vu5DZZIt8H2dUOKW2DBZz3KaaFWtaPJRYCEPNp6YE/Wbwhcy06KRsekUZ5V/7gCN3Eg=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/power-assert-plus/MAL-2026-13958.json"