MAL-2026-13953 Malicious code in js-assert-plus (npm)
Malicious package
Published
MAL-2026-13953 is a malicious package: js-assert-plus (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-13953/ (Markdown: https://insights.sbomify.com/MAL-2026-13953/index.md)
- Package
- js-assert-plus
- Registry
- npm
What is MAL-2026-13953?
MAL-2026-13953 is a malicious package in js-assert-plus, published on 13 Aug 2026.
Official description
The npm package js-assert-plus masquerades as an assertion library (homepage http://js-assert-plus.com) and bundles the real chai source so consumers get working functionality while a loader runs on every require/import. index.js hex-decodes the strings 'child_process' and 'spawn' and spawns a detached node subprocess running lib/chai/utils/assertion.js. That sibling module is packed with obfuscator.io string-array obfuscation (rotated array _0x1b90, base64+decodeURIComponent decoder) that reconstructs a URL at runtime, performs an https GET, and passes the response body to new Function('require', body)(require) — executing attacker-controlled JavaScript on the installer's machine with require in scope. Both the require of child_process and the network destination are hidden behind runtime string reconstruction so static inspection cannot see the endpoint.
What should I do about MAL-2026-13953?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.