power-assert-plus @1.2.2

Summary

power-assert-plus is a typosquat of power-assert. On every require(), index.js detach-spawns node build/power-assert-plus.js . That build file is obfuscator.io-encoded (string-array + custom base64 alphabet) and, after decoding, dynamically requires http/https, GETs a remote URL, and passes the response body to new Function('require', body)(require) , executing attacker-controlled JavaScript with Node's require in the installer's process context. The README frames build/power-assert-plus.js as a browserify bundle of the library, but the shipped 4KB payload is a network loader with no assertion library code; the module name, host, and eval sink are all hidden behind the string-array decoder.

Source: amazon-inspector (ff97d4bae356db6a165ae845ee186c814f89bd1ee40e839d6da054965bfbd823)