MAL-2026-13953
Malicious code in js-assert-plus (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (acbf16a8956847ff7ed56158afe65bc0bf76cb36f8cb6af6bc143cae4cb9babe) The npm package js-assert-plus masquerades as an assertion library (homepage http://js-assert-plus.com) and bundles the real chai source so consumers get working functionality while a loader runs on every require/import. index.js hex-decodes the strings 'child_process' and 'spawn' and spawns a detached node subprocess running lib/chai/utils/assertion.js. That sibling module is packed with obfuscator.io string-array obfuscation (rotated array _0x1b90, base64+decodeURIComponent decoder) that reconstructs a URL at runtime, performs an https GET, and passes the response body to new Function('require', body)(require) — executing attacker-controlled JavaScript on the installer's machine with require in scope. Both the require of child_process and the network destination are hidden behind runtime string reconstruction so static inspection cannot see the endpoint.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for js-assert-plus (npm). Pin to a known-safe version or switch to an alternative.