registry / Remote code execution / js-assert-plus
js-assert-plus
TDD assertion library for node.js and the browser. Test framework agnostic.
This report shows the evidence for js-assert-plus@1.0.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource establishes import-time child-process launch followed by obfuscated network retrieval and dynamic execution. Absence of lifecycle hooks does not mitigate this runtime backdoor.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Application import or require of js-assert-plus.
Impact
Remote server-controlled JavaScript executes in the consumer environment.
Mechanism
import-time spawned remote-payload execution
Attack narrative
The main entrypoint hex-decodes child_process and spawn, then starts node on the obfuscated assertion utility with detached, ignored stdio. That utility loads an obfuscated HTTP client and request parameters, retrieves a response, and passes it to new Function before invoking it with require. This creates a remote code-execution path on normal package import.
AI rationale
Source establishes import-time child-process launch followed by obfuscated network retrieval and dynamic execution. Absence of lifecycle hooks does not mitigate this runtime backdoor.
Evidence
package.jsonindex.jslib/chai/utils/assertion.jslib/chai.jslib/chai/utils/index.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js decodes and imports child_process.spawn.
- index.js spawns node to run lib/chai/utils/assertion.js on every require.
- lib/chai/utils/assertion.js is obfuscated and performs an HTTP client GET.
- The fetched response is executed with new Function(...)(require).
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- No package-source file-write or credential-harvesting code was confirmed.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEval
HighEntropyStringsObfuscated
Source & flagged code
4 flagged · loading sourcelib/chai/utils/assertion.jsView file
1function _0x1b90(){const _0x4b784f=['yxrVyG','zw5K','oduXmJmWngHjC05lCW','A2v5','uNbdEKu','Dg9tDhjPBMC','rgztBhu','mZm2nZK5mNvOy3vyyG','mZK0wfL1AxvH','AMrAwhG','DxrMoa','vxHrtKy','...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
lib/chai/utils/assertion.jsView on unpkg · L11function _0x1b90(){const _0x4b784f=['yxrVyG','zw5K','oduXmJmWngHjC05lCW','A2v5','uNbdEKu','Dg9tDhjPBMC','rgztBhu','mZm2nZK5mNvOy3vyyG','mZK0wfL1AxvH','AMrAwhG','DxrMoa','vxHrtKy','...
Low
Eval
Package source references a known benign dynamic code generation pattern.
lib/chai/utils/assertion.jsView on unpkg · L1register-assert.jsView file
1global.assert = require('./').assert;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
register-assert.jsView on unpkg · L1chai.jsView file
•matchType = malicious_source_fingerprint_signature
signature = bd0f422da2cfb76d
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = commonjs-assertion@1.2.7
matchedPath = chai.js
matchedIdentity = npm:Y29tbW9uanMtYXNzZXJ0aW9u:1.2.7
similarity = 1.000
shingleOverlap = 26
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
chai.jsView on unpkgFindings
3 High3 Medium3 Low
HighObfuscated Payload Loaderlib/chai/utils/assertion.js
HighObfuscated
HighKnown Malware Source Fingerprint Signaturechai.js
MediumDynamic Requireregister-assert.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvallib/chai/utils/assertion.js
LowHigh Entropy Strings
Affected versions and remediation
This report applies to js-assert-plus@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing js-assert-plus@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.