minimalistic-assert-plus@1.1.7

Summary

The package typosquats minimalistic-assert and re-ships the Chai library alongside a malicious dispatcher. On require('minimalistic-assert-plus'), index.js spawns a detached Node child (spawn('node', [assertion,...], {detached:true, stdio:'ignore'})) that runs lib/chai/utils/expectAssertion.js. That file is heavily obfuscated (obfuscator.io string-array + base64 rotation, hex-named identifiers such as _0x4b784f, _0x51bd34) and at runtime constructs an HTTP URL, performs an http.get, and passes the response body to new Function(..., body)(require) — evaluating attacker-supplied JavaScript with the real Node require in scope. Stdio is ignored and the process is detached to evade observation. Package metadata is deceptive: name mimics minimalistic-assert, description is copied from Chai, and homepage points to minimalistic-assert-plus.com.

Source: amazon-inspector (e59f4af9a6f3f95bf4cf795fb91bcf4c7934dbb90e64d750255a2a786ed7dc75)