minimalistic-assert-plus@1.1.7

Analysis

minimalistic-assert-plus@1.1.7 is a trojanized clone of the chai assertion library. On require, index.js spawns a detached background node process (stdio ignored, unref'd) that runs an obfuscated loader (lib/chai/utils/expectAssertion.js). The loader decodes an obfuscated string array, builds a URL, and makes an HTTP GET to coolblast[.]zapto[.]org:8888/api/x-handler?key=W7qL9!mX2, then evaluates the response body via new Function with the require function passed in — executing arbitrary remote code returned by the server. The C2 host and request key are hardcoded/obfuscated in the payload.