MalwarePublished 24 Jun 2026Updated 15 Jul 2026

assertcore (npm) · Malicious Code

Affects assertcoreSource GCVE Database

Malicious package : remove assertcore and rotate any secrets on hosts that installed it.

Data as of 15 Jul 2026, 12:54 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6365

What to do

Remove assertcore from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmassertcore	Affected =3.1.7	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'assertcore' impersonates the popular 'chai' assertion library by including chai source code as a cover while differing in author and homepage. Upon requiring or importing 'assertcore', it spawns a detached, silent Node.js subprocess that executes heavily obfuscated code. This code fetches attacker-controlled JavaScript from a remote URL and executes it with full Node privileges, resulting in a supply-chain attack. The malicious behavior occurs at install or require time, potentially compromising any system using this package version. Removal of the package does not guarantee full remediation due to possible persistent compromise.

Impact

Systems with 'assertcore' version 3.1.7 installed or running are fully compromised, as the package executes attacker-supplied code with full Node.js privileges. This can lead to unauthorized access, data exfiltration, and control over the affected system. All secrets and keys stored on the compromised system should be considered exposed and require immediate rotation from a secure environment. Removing the package alone may not eliminate all malicious artifacts or backdoors introduced by the attacker.

Defensive guidance

The recommended mitigation is to immediately remove 'assertcore' version 3.1.7 from all systems. Assume full compromise of affected systems and rotate all secrets and credentials from a different, secure machine. Conduct a thorough investigation for persistence mechanisms or additional malware. Avoid installing packages with suspicious or impersonating names and verify package authenticity before use.

Summary

The 'assertcore' npm package version 3.1.7 is a malicious package that impersonates the legitimate 'chai' library by shipping chai source code as a cover. When required or imported, it spawns a detached Node.js subprocess running an obfuscated script that performs an HTTP GET request to an attacker-controlled URL. The response is executed dynamically with full Node.js privileges, enabling arbitrary code execution on the host system. This behavior constitutes a supply-chain attack that compromises the security of any system installing or using this package. The attack vector leverages obfuscation techniques and silent subprocess execution to evade detection.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Jul 2026, 12:54 UTC

Technical details

References

Community reviews