Malicious code in minimalistic-assert-plus (npm)
minimalistic-assert-plus is a typosquatting package on npm that mimics minimalistic-assert but contains malicious code. Upon require, it spawns a detached Node process that fetches and executes arbitrary JavaScript from an attacker-controlled server with full require() access.
- Disclosed
- Last updated
- Blast radius
- Any npm project that installed minimalistic-assert-plus
- Ecosystems
- Attack vectors
- Affected entities
- minimalistic-assert-plusTyposquatting package on npm
minimalistic-assert-plus is a malicious npm package that typosquats the legitimate minimalistic-assert library. The package uses deceptive metadata, copying the description from the Chai library and pointing its homepage to minimalistic-assert-plus.com to appear legitimate.
When the package is required, index.js spawns a detached Node child process that executes heavily obfuscated code from lib/chai/utils/expectAssertion.js. The obfuscated file uses obfuscator.io string-array and base64 rotation techniques with hex-named identifiers to evade analysis.
At runtime, the obfuscated code constructs an HTTP URL, performs an http.get request, and passes the response body to new Function(..., body)(require), evaluating attacker-supplied JavaScript with access to the real Node require function. The process is detached and stdio is ignored to avoid detection.
The package was identified by the OpenSSF malicious-packages project and assigned identifier MAL-2026-13954.
Indicators of compromise
- Packages
- minimalistic-assert-plus
Remediation
- Remove minimalistic-assert-plus from all dependencies immediately
- Audit package-lock.json and yarn.lock for any installations of minimalistic-assert-plus
- Replace with the legitimate minimalistic-assert package if needed
- Review any systems where minimalistic-assert-plus was installed for signs of compromise or unauthorized network activity
- Regenerate any credentials or secrets that may have been exposed on affected systems
Sources
- GitHub Advisory GHSA-35q8-7f5w-wv67 · GitHub Advisory Database
Cite this entry
"Malicious code in minimalistic-assert-plus (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-minimalistic-assert-plus-npm-1scjxb
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package