commonjs-assertion
TDD assertion library for node.js and the browser. Test framework agnostic.
This report shows the evidence for commonjs-assertion@1.2.7, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection confirms an import-time detached payload launcher and an obfuscated remote dynamic-code loader. The absence of lifecycle hooks does not mitigate runtime compromise on import.
Decision evidence
public snapshot- index.js decodes child_process.spawn and invokes it on every import.
- index.js detached-spawns node with lib/chai/utils/assertion.js and ignored stdio.
- lib/chai/utils/assertion.js is an obfuscated remote-response loader ending in new Function(...)(require).
- The spawned payload constructs a request with encoded package data and executes its response.
- package.json has no install lifecycle hook.
- No cleartext endpoint or file-write primitive was recoverable from the obfuscated payload.
Source & flagged code
3 flagged · loading sourceSource contains an obfuscated payload loader that reconstructs and executes hidden code.
lib/chai/utils/assertion.jsView on unpkg · L1Package source references a known benign dynamic code generation pattern.
lib/chai/utils/assertion.jsView on unpkg · L1Package source references dynamic require/import behavior.
Findings
Affected versions and remediation
This report applies to commonjs-assertion@1.2.7.
The versions list below shows the verdict for each recorded version.
- Avoid installing commonjs-assertion@1.2.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.