{"id":"MAL-2026-5933","summary":"Malicious code in react-vite-assert (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (746aecfafda9a8f780b53ef40a5697875c52514dfa6ebb29306992ad06128395)\nreact-vite-assert@1.4.1 executes attacker-controlled JavaScript whenever the package is imported. The main entry transitively loads src/features/extras/config.js, which runs a top-level async IIFE that issues an HTTPS GET to https://www.jsonkeeper.com/b/HXDNM, takes the `data.config` string from the response, wraps it with `new Function('require', s)`, and invokes it with a `createRequire(import.meta.url)`-built `require` — granting the fetched code full Node.js access (filesystem, network, child_process, env). The fetch is retried up to 5 times. The remote URL and request headers are disguised by a fake local `process` shadow object whose keys are named DEV_API_KEY/DEV_SECRET_KEY/DEV_SECRET_VALUE, where DEV_API_KEY actually holds the paste URL and the other two hold a request header name/value — deliberate misdirection rather than configuration. jsonkeeper.com is an anonymous, mutable paste host: whoever controls /b/HXDNM can change the executed payload at any time without republishing the package. The combination of import-time auto-execution, anonymous mutable code source, eval of fetched bytes with full `require`, and cover-story variable naming is unambiguous supply-chain attack tradecraft.\n","modified":"2026-06-16T23:16:56.718928406Z","published":"2026-06-16T22:20:27Z","database_specific":{"malicious-packages-origins":[{"sha256":"746aecfafda9a8f780b53ef40a5697875c52514dfa6ebb29306992ad06128395","source":"amazon-inspector","versions":["1.4.1"],"id":"IN-MAL-2026-006845","import_time":"2026-06-16T23:03:43.547587086Z","modified_time":"2026-06-16T22:20:27Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/react-vite-assert/v/1.4.1"}],"affected":[{"package":{"name":"react-vite-assert","ecosystem":"npm","purl":"pkg:npm/react-vite-assert"},"versions":["1.4.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"d2c9cc973ef588acad719b4a4d8dcd6d088f224450b9ef9eeb717b8c9f3d64ba","tlsh":"e601bd8fa1ac140c057013e7bb1be036f662b1ab390381d5775cc7521fb695ca602ede","path":"src/features/extras/config.js"}],"package_integrity":[{"filename":"react-vite-assert-1.4.1.tgz","hashes":{"sha1":"d6bd02f9d25ef59286509f280f9ad7fe410373f6","sha512_sri":"sha512-yQR1Zt0WASthdm81PWQVuMCoqnB1jQpWg/rhwloh8wUN7Jc2018x4KgfnHEVrgLsP99bJPUTz5tf1ybIw5otyQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-vite-assert/MAL-2026-5933.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}