MAL-2026-13958
Malicious code in power-assert-plus (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (ff97d4bae356db6a165ae845ee186c814f89bd1ee40e839d6da054965bfbd823) power-assert-plus is a typosquat of power-assert. On every require(), index.js detach-spawns `node build/power-assert-plus.js`. That build file is obfuscator.io-encoded (string-array + custom base64 alphabet) and, after decoding, dynamically requires http/https, GETs a remote URL, and passes the response body to `new Function('require', body)(require)`, executing attacker-controlled JavaScript with Node's require in the installer's process context. The README frames build/power-assert-plus.js as a browserify bundle of the library, but the shipped 4KB payload is a network loader with no assertion library code; the module name, host, and eval sink are all hidden behind the string-array decoder.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for power-assert-plus (npm). Pin to a known-safe version or switch to an alternative.