minimalistic-assert-plus @1.1.7

Summary

The package typosquats minimalistic-assert and re-ships the Chai library alongside a malicious dispatcher. On require('minimalistic-assert-plus') , index.js spawns a detached Node child ( spawn('node', [assertion,...], {detached:true, stdio:'ignore'}) ) that runs lib/chai/utils/expectAssertion.js. That file is heavily obfuscated (obfuscator.io string-array + base64 rotation, hex-named identifiers such as _0x4b784f, _0x51bd34) and at runtime constructs an HTTP URL, performs an http.get , and passes the response body to new Function(..., body)(require) — evaluating attacker-supplied JavaScript with the real Node require in scope. Stdio is ignored and the process is detached to evade observation. Package metadata is deceptive: name mimics minimalistic-assert , description is copied from Chai, and homepage points to minimalistic-assert-plus.com .

Source: amazon-inspector (e59f4af9a6f3f95bf4cf795fb91bcf4c7934dbb90e64d750255a2a786ed7dc75)