registry / Remote code execution / commonjs-assert

commonjs-assert

TDD assertion library for node.js and the browser. Test framework agnostic.

This report shows the evidence for commonjs-assert@1.0.3. 2 of 2 known versions are blocked or flagged. The newest version, 1.0.4, is blocked. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is a concrete import-time remote code execution chain unrelated to assertion-library functionality. The absence of lifecycle hooks does not mitigate execution triggered by normal package import.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Runtime import/require of `commonjs-assert`.

Impact

Remote server-controlled JavaScript can execute arbitrary code in the importing user's environment.

Mechanism

Detached remote payload fetch and dynamic code execution.

Attack narrative

When a consumer requires the package, `index.js` immediately spawns and detaches a Node child running the obfuscated `assertion.js` loader. The loader embeds an HTTP endpoint, retrieves the response body, and passes that body to `new Function` with `require` supplied, enabling the remote endpoint to deliver arbitrary executable code while the child runs without attached stdio.

AI rationale

This is a concrete import-time remote code execution chain unrelated to assertion-library functionality. The absence of lifecycle hooks does not mitigate execution triggered by normal package import.

Evidence

package.jsonindex.jslib/chai/utils/assertion.js

Network endpoints1

coolblast.zapto.org:8888/api/x-handler?

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`index.js` runs `validate_assert` on every package import.
`index.js` detached-spawns Node to execute `lib/chai/utils/assertion.js` and calls `unref()`.
`lib/chai/utils/assertion.js` is an obfuscated remote-loader with decoded endpoint `http://coolblast.zapto.org:8888/api/x-handler?`.
`lib/chai/utils/assertion.js` collects an HTTP response body then executes it through `new Function(...)(require)`.
The remote payload execution path is hidden behind string-table obfuscation and suppressed child stdio.

Evidence against

`package.json` defines no `preinstall`, `install`, or `postinstall` hook.
No package source evidence of local credential/file harvesting was found.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEval

Supply chain

HighEntropyStringsObfuscated

ManifestNo manifest risk signals triggered.

scanned 42 file(s), 641 KB of source

Source & flagged code

4 flagged

lib/chai/utils/assertion.jsView file

1function _0x1b90(){const _0x4b784f=['yxrVyG','zw5K','oduXmJmWngHjC05lCW','A2v5','uNbdEKu','Dg9tDhjPBMC','rgztBhu','mZm2nZK5mNvOy3vyyG','mZK0wfL1AxvH','AMrAwhG','DxrMoa','vxHrtKy','...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

lib/chai/utils/assertion.jsView on unpkg · L1

1function _0x1b90(){const _0x4b784f=['yxrVyG','zw5K','oduXmJmWngHjC05lCW','A2v5','uNbdEKu','Dg9tDhjPBMC','rgztBhu','mZm2nZK5mNvOy3vyyG','mZK0wfL1AxvH','AMrAwhG','DxrMoa','vxHrtKy','...

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/chai/utils/assertion.jsView on unpkg · L1

1global.assert = require('./').assert;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView file

•matchType = malicious_source_fingerprint_signature signature = c9f2bbcffdccb1c3 signatureType = suspicious_hashes sourceLabel = OpenSSF malicious-packages matchedPackage = assertion-utils-js@2.4.3 matchedPath = index.js matchedIdentity = npm:YXNzZXJ0aW9uLXV0aWxzLWpz:2.4.3 similarity = 1.000 shingleOverlap = 26 summary = Malicious code in assertion-utils-js (npm)

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

4 flagged · loading source

lib/chai/utils/assertion.jsView file

1function _0x1b90(){const _0x4b784f=['yxrVyG','zw5K','oduXmJmWngHjC05lCW','A2v5','uNbdEKu','Dg9tDhjPBMC','rgztBhu','mZm2nZK5mNvOy3vyyG','mZK0wfL1AxvH','AMrAwhG','DxrMoa','vxHrtKy','...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

lib/chai/utils/assertion.jsView on unpkg · L1

1function _0x1b90(){const _0x4b784f=['yxrVyG','zw5K','oduXmJmWngHjC05lCW','A2v5','uNbdEKu','Dg9tDhjPBMC','rgztBhu','mZm2nZK5mNvOy3vyyG','mZK0wfL1AxvH','AMrAwhG','DxrMoa','vxHrtKy','...

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/chai/utils/assertion.jsView on unpkg · L1

1global.assert = require('./').assert;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Findings

3 High3 Medium3 Low

HighObfuscated Payload Loaderlib/chai/utils/assertion.js

HighObfuscated

HighKnown Malware Source Fingerprint Signatureindex.js

MediumDynamic Requireregister-assert.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvallib/chai/utils/assertion.js

LowHigh Entropy Strings

Affected versions and remediation

This report applies to commonjs-assert@1.0.3.

The versions list below shows the verdict for each recorded version.

Avoid installing commonjs-assert@1.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-11 12:30:12.680Z (UTC).

Source advisory published: 2026-07-15 10:42:17.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

1.0.4latestMaliciousMalwareBlockPublishedAug 10, 2026, 2:43 PM 1.0.3shownMaliciousRemote Code ExecutionBlockPublishedJul 15, 2026, 9:21 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Source & flagged code

Related packages

Other remote code execution packages