MAL-2026-13954

Dashboard / Malicious Package / MAL-2026-13954

MAL-2026-13954

Summary: Malicious code in minimalistic-assert-plus (npm)

Details: Source: amazon-inspector (e59f4af9a6f3f95bf4cf795fb91bcf4c7934dbb90e64d750255a2a786ed7dc75) The package typosquats `minimalistic-assert` and re-ships the Chai library alongside a malicious dispatcher. On `require('minimalistic-assert-plus')`, index.js spawns a detached Node child (`spawn('node', [assertion,...], {detached:true, stdio:'ignore'})`) that runs lib/chai/utils/expectAssertion.js. That file is heavily obfuscated (obfuscator.io string-array + base64 rotation, hex-named identifiers such as _0x4b784f, _0x51bd34) and at runtime constructs an HTTP URL, performs an `http.get`, and passes the response body to `new Function(..., body)(require)` — evaluating attacker-supplied JavaScript with the real Node `require` in scope. Stdio is ignored and the process is detached to evade observation. Package metadata is deceptive: name mimics `minimalistic-assert`, description is copied from Chai, and homepage points to `minimalistic-assert-plus.com`.

References: https://www.npmjs.com/package/minimalistic-assert-plus/v/1.1.7