MAL-2026-13953

    Dashboard / Malicious Package / MAL-2026-13953

    MAL-2026-13953

    Published: 13 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in js-assert-plus (npm)

    Details: Source: amazon-inspector (acbf16a8956847ff7ed56158afe65bc0bf76cb36f8cb6af6bc143cae4cb9babe) The npm package js-assert-plus masquerades as an assertion library (homepage http://js-assert-plus.com) and bundles the real chai source so consumers get working functionality while a loader runs on every require/import. index.js hex-decodes the strings 'child_process' and 'spawn' and spawns a detached node subprocess running lib/chai/utils/assertion.js. That sibling module is packed with obfuscator.io string-array obfuscation (rotated array _0x1b90, base64+decodeURIComponent decoder) that reconstructs a URL at runtime, performs an https GET, and passes the response body to new Function('require', body)(require) — executing attacker-controlled JavaScript on the installer's machine with require in scope. Both the require of child_process and the network destination are hidden behind runtime string reconstruction so static inspection cannot see the endpoint.

    References: https://www.npmjs.com/package/js-assert-plus/v/1.0.0

    Affected packages

    Package

    Name: js-assert-plus

    Purl: pkg:npm/js-assert-plus

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0