Malicious Code Detected in assert-json-not Package - Security Risk Alert
Summary
MAL-2025-192711: Malicious code in assert-json-not (npm). Affects assert-json-not versions 2.3.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The assert-json-not package is a utility in the npm ecosystem designed to facilitate JSON assertion testing. It allows developers to validate JSON structures against expected formats, making it a valuable tool for ensuring data integrity in applications. However, recent findings have revealed that this package has been compromised, introducing malicious code that poses significant security risks to users.
Vulnerability Detail
The vulnerability stems from the inclusion of malicious code in version 2.3.5 of the assert-json-not package. This code can potentially execute harmful operations on the user's system, leading to unauthorized access, data breaches, or other malicious activities. The origin of this vulnerability is linked to a malicious actor who has tampered with the package, making it imperative for users to be vigilant and take immediate action to mitigate risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall assert-json-notIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the assert-json-not package until a safe version is confirmed. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The discovery of malicious code in the assert-json-not package highlights the importance of vigilance in managing open-source dependencies. Users are urged to update their packages promptly and consider using tools like Vulert to monitor for vulnerabilities in real-time.
See every vulnerability recorded for assert-json-not →
FAQ
The assert-json-not package is an npm utility used for validating JSON structures against expected formats.
The malicious code was introduced by a malicious actor who tampered with version 2.3.5 of the assert-json-not package.
Using the compromised package can lead to unauthorized access, data breaches, and other harmful operations on your system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If immediate updates are not possible, refrain from using the assert-json-not package and look for alternative solutions until a safe version is available.
