Malicious code in power-assert-plus (npm)
power-assert-plus is a typosquat package on npm containing malicious code that executes attacker-controlled JavaScript on every require(). The package spawns a network loader that fetches and executes remote code with Node.js require privileges.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed power-assert-plus
- Ecosystems
- Attack vectors
- Affected entities
- power-assert-plusTyposquat of power-assert; malicious code in index.js and build/power-assert-plus.js
power-assert-plus is a typosquatting attack targeting the legitimate power-assert library on npm. The malicious package contains obfuscated code in its build/power-assert-plus.js file that is executed every time the module is required.
The attack mechanism uses obfuscator.io encoding (string-array with custom base64 alphabet) to hide its true functionality. When decoded, the payload dynamically requires Node's http/https modules, fetches a remote URL, and passes the response body to new Function('require', body)(require), executing arbitrary attacker-controlled JavaScript with full Node.js require capabilities in the installer's process context.
The package falsely presents the build file as a browserify bundle of the assertion library, but the actual 4KB payload contains only a network loader with no legitimate assertion library code. The module name, host, and eval sink are all concealed behind the string-array decoder to evade detection.
This incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- power-assert-plus
Remediation
- Immediately uninstall power-assert-plus from all projects and systems
- Use the legitimate power-assert package instead
- Audit npm install logs and package-lock.json files to identify when power-assert-plus was installed
- Review any systems where power-assert-plus was installed for signs of compromise or data exfiltration
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Monitor for suspicious network connections or unexpected process spawning on affected machines
Sources
- GitHub Advisory GHSA-h4w5-6wqw-743j · GitHub Advisory Database
Cite this entry
"Malicious code in power-assert-plus (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-power-assert-plus-npm-1r2s2m
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in ladash-cli (npm)
ladash-cli is a typosquat package on npm that executes malicious code during installation. The postinstall script downloads and executes a Windows binary, with special handling for WSL environments to compromise the underlying Windows host.
npmTyposquattingCompromised package - containedcritical
Malicious code in comand (npm)
The npm package 'comand' contained malicious code that executed automatically on install via postinstall.js, exfiltrating platform information and downloading an unsigned executable (main.exe) to Windows systems or via WSL PowerShell bridges. The package name appears to be a typosquat of 'command', and the GitHub owner (braz1) does not match the npm publisher.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in core-js-gns (npm)
The npm package core-js-gns contained malicious code in its postinstall hook that exfiltrated system information and executed remotely-fetched Python code on developer machines. The package name was a typosquat of the legitimate core-js library.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in comander-lib (npm)
comander-lib@1.0.0 is a typosquat of the legitimate `commander` package containing malicious code. The package's postinstall script exfiltrates system information to a C2 server and downloads and executes a Windows payload, with capability to escape WSL/Linux sandboxes via PowerShell.
npmTyposquattingCompromised package