registry / js-assert-plus / 1.0.0

js-assert-plus@1.0.0

TDD assertion library for node.js and the browser. Test framework agnostic.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Requiring the package launches a detached child Node process. That process fetches an obfuscated remote payload and executes it.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Application import or require of js-assert-plus.

Impact

Remote server-controlled JavaScript executes in the consumer environment.

Mechanism

import-time spawned remote-payload execution

Attack narrative

The main entrypoint hex-decodes child_process and spawn, then starts node on the obfuscated assertion utility with detached, ignored stdio. That utility loads an obfuscated HTTP client and request parameters, retrieves a response, and passes it to new Function before invoking it with require. This creates a remote code-execution path on normal package import.

Rationale

Source establishes import-time child-process launch followed by obfuscated network retrieval and dynamic execution. Absence of lifecycle hooks does not mitigate this runtime backdoor.

Evidence

package.jsonindex.jslib/chai/utils/assertion.jslib/chai.jslib/chai/utils/index.js

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

js-assert-plus@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code