assert-kit@4.3.2

Analysis

assert-kit@4.3.2 is a trojanized clone of the chai assertion library. On require(), it spawns a detached background Node.js process that makes an HTTP GET request to senpad[.]bounceme[.]net:6285/api/x-handler?key=River!Stone9Galaxy_Wind and executes the server's response as code via new Function("require", body), giving the attacker arbitrary code execution in the installer's environment. The payload is heavily obfuscated using javascript-obfuscator to hide the C2 URL and code structure. The package has no lifecycle hooks — infection occurs the moment the package is imported into any project.